Security Requirements Analysis Report

Comprehensive Security Analysis with Interactive Dashboard

Author

Security Requirements System v2.0

Published

November 19, 2025

Generated: 2025-11-19 19:29:59 Report Version: 2.0 - Comprehensive Security Analysis

1. Executive Summary

This section provides a high-level overview of the security requirements analysis, presenting key findings, validation results, and an interactive dashboard for stakeholders and decision-makers. The executive summary enables rapid comprehension of the security posture, critical risks, control coverage, and compliance status without requiring detailed technical knowledge.

1.1. Purpose and Scope

Purpose

This document presents a comprehensive security requirements analysis for the proposed application, systematically mapping high-level business requirements to specific, actionable security controls aligned with multiple industry standards: OWASP Application Security Verification Standard (ASVS), NIST SP 800-53 Rev 5, and ISO 27001:2022. The analysis provides a complete security requirements specification that guides secure system design, implementation, and verification.

Scope

This analysis encompasses all functional requirements provided, delivering comprehensive coverage across multiple security domains:

Requirements Analysis: Systematic decomposition and security-relevant extraction from business requirements
Stakeholder Analysis: Identification of stakeholders, trust boundaries, and security responsibilities
Threat Modeling: Systematic identification and assessment of security threats using STRIDE methodology
Security Control Mapping: Mapping requirements to multi-standard security controls (OWASP ASVS, NIST SP 800-53, ISO 27001) with detailed implementation guidance
Compliance Requirements: Identification of regulatory and legal compliance obligations
Architectural Security: Security architecture recommendations and design patterns
Implementation Planning: Prioritized, phased implementation roadmap
Verification Strategies: Testing and validation approaches for security controls

The analysis provides both strategic guidance for security planning and tactical details for implementation teams.

1.2. Key Findings

This section summarizes the most critical results from the security requirements analysis, providing executives and stakeholders with immediate insight into the security posture and validation status.

Analysis Metrics

Validation Score: 0.81/1.0
Validation Status: ✅ Passed
Analysis Iterations: 1
Requirements Analyzed: 20

Application Summary

A multi-tenant web application to manage employee shift types, scheduling, assignments, preferences, and leave, with role-based access for Admins, Managers, and Employees and an automated optimization workflow that integrates with an external solver (Timefold) to generate, preview, score, and accept/reject optimized assignments while providing calendar views, export capabilities, and multilingual UI.

The validation score reflects the quality and completeness of the security requirements across five dimensions: completeness, consistency, correctness, implementability, and alignment with business objectives. A score of 0.8 or higher indicates that the requirements are ready for implementation, while scores below this threshold may require refinement before proceeding.

1.3. Security Overview Dashboard

This interactive dashboard provides executive-level visualization of key security metrics and trends, enabling rapid assessment of the security posture through intuitive charts and data visualizations. The dashboard presents critical information across multiple dimensions: risk distribution, security control coverage, compliance status, implementation progress, and data quality metrics. For optimal viewing experience, render this document with Quarto to enable interactive chart functionality, allowing stakeholders to explore data dynamically and drill down into specific areas of interest.

Figure 1: Risk heat map showing threat distribution by likelihood and impact (1-5 scale).

Top 5 Highest Risks:

THR-001 (Critical) - Frontend Layer (SPA) - Calendar & Tables - Category: Information Disclosure / Spoofing - Likelihood: 4 | Impact: 4 - Description: Reflected or stored XSS in UI (calendar, shift preview, user profile) allows an attacker to run JS in another user’s session, exfiltrate session tokens, hijack accounts, or perform actions on behalf o

THR-008 (Critical) - Application Services - Authentication - Category: Spoofing - Likelihood: 4 | Impact: 4 - Description: Credential stuffing, weak passwords, or lack of MFA leads to account takeover of ADMIN/MANAGER accounts allowing large-scale damage.

THR-003 (High) - Frontend Layer (Token Handling) - Category: Spoofing / Information Disclosure - Likelihood: 3 | Impact: 4 - Description: Session tokens or OAuth tokens stored insecurely in localStorage or accessible JS can be stolen via XSS or malicious extensions, enabling account takeover.

THR-004 (High) - Frontend Layer / External Services (Google OAuth) - Category: Spoofing - Likelihood: 3 | Impact: 4 - Description: Open redirect or incorrect OAuth redirect URI validation allows attackers to capture authorization codes or tokens via a malicious callback, leading to account takeover.

THR-005 (High) - Edge Layer (CDN/WAF/TLS) - Category: Information Disclosure / Tampering - Likelihood: 3 | Impact: 4 - Description: TLS termination or CDN misconfiguration (weak ciphers, expired certs, missing HSTS) could allow MitM, protocol downgrade, or data interception between clients and edge.

Figure 2: Security control distribution by standard (OWASP, NIST, ISO 27001).

Figure 3: OWASP ASVS control distribution by verification category (V1-V14).

Figure 4: Security control priority distribution (Critical/High/Medium/Low).

Coverage Metrics:

Total Security Controls Mapped: 80
- OWASP ASVS: 26 controls
- NIST SP 800-53: 34 controls
- ISO 27001: 20 controls
Requirements with Security Control Mapping: 76.0% (19/25)
Average Controls per Requirement: 3.2
Critical Controls: 17 (21.2% of total)
Requirements with Verification: 100.0% (25/25)
Recommended ASVS Level: L2 (Standard)

Figure 5: Compliance status across all applicable frameworks (Red-Amber-Green rating). Shows regulatory compliance (GDPR, HIPAA, PCI-DSS, etc.) and security standards (OWASP ASVS, NIST SP 800-53, ISO 27001).

Compliance Summary:

⚠️ GDPR: In Progress (Next Audit: TBD)
⚠️ OWASP ASVS: In Progress (Next Audit: N/A)
⚠️ NIST SP 800-53: In Progress (Next Audit: N/A)
⚠️ ISO 27001: In Progress (Next Audit: N/A)

Figure 6: Projected implementation timeline by phase and week (based on priority-based planning).

Implementation Timeline (Projected):

Phase 1 (Critical/High): 100% projected completion (Weeks 1-8)
Phase 2 (Medium): 100% projected completion (Weeks 9-16)
Phase 3 (Low/Ongoing): Continuous improvement and monitoring

Note: Timeline is based on priority-based planning and assumes steady implementation progress.

Validation Metrics:

Overall Validation Score: ✅ 0.81/1.0

Dimension Scores:

⚠️ Completeness: 0.72
✅ Consistency: 0.88
✅ Correctness: 0.84
⚠️ Implementability: 0.76
✅ Alignment: 0.86

Figure 7: Data quality and coverage metrics.

Traceability Matrix:

Total Requirements: 25
Linked to Threats: 25 (100.0%)
Mapped to Security Controls: 19 (76.0%)
With Verification: 25 (100.0%)

Data Quality: ✅ Excellent

2. Requirements Understanding

This section presents a comprehensive analysis of the functional requirements, extracting security-relevant information and establishing the foundation for the security requirements specification. Understanding the functional requirements is essential for identifying security implications, data sensitivity, trust boundaries, and security-critical components. This analysis transforms business requirements into security-aware specifications that inform threat modeling, control selection, and compliance assessment.

2.1. High-Level Requirements Analysis

The following high-level functional requirements have been identified and analyzed for security implications:

User registration with email verification and account lifecycle management
Authentication and single sign-on via credentials and Google OAuth
Password reset and account recovery
Role-based access control (ADMIN, MANAGER, EMPLOYEE) and user status management
User profile management and company assignment
Company CRUD and multi-tenant scoping of data
Shift type management with time ranges and required skills
Manual shift creation, update, deletion, and calendar presentation
Shift status tracking and filtering (SCHEDULED, CONFIRMED, COMPLETED, CANCELLED, NO_SHOW)
Automated shift assignment (auto-assignment) via external solver with preview and accept/reject
Real-time asynchronous job processing, polling, and solution status tracking
Solution scoring, constraint violation analysis, and reporting
Shift preferences management (date-specific desired/undesired) and preference tracking
Unavailable dates and leave management (multiple leave types, date ranges, reasons)
Skills management and skill-based matching for assignments
Export of data (shifts, users, companies, skills, shift types, preferences, unavailable dates) in CSV/XLSX
External API integration with Timefold solver including payload generation and solution parsing
Internationalization (multi-language UI and localized date/time formatting)
User interface features: responsive navigation, tables with pagination/sorting/filtering, calendar views, alerts/notifications, breadcrumbs
Audit logging, legal documents availability (Privacy Policy, Terms of Service), and consent tracking

2.2. Detailed Requirements Breakdown

Req ID	Requirement	Business Category	Security Sensitivity	Data Classification
REQ-001	User registration with email verification and acco…	Authentication / Identity Management	High	Confidential
REQ-002	Authentication supporting credentials-based login …	Authentication / Integration	High	Confidential
REQ-003	Password reset and account recovery flows with sec…	Authentication / Account Recovery	High	Confidential
REQ-004	Role-based access control (ADMIN, MANAGER, EMPLOYE…	Authorization / Multi-tenancy	High	Confidential
REQ-005	User profile management, including personal detail…	Data Management / User Management	Medium	Confidential
REQ-006	Admin-only company CRUD and multi-tenant data isol…	Multi-tenant Administration	High	Internal
REQ-007	Create, read, update, delete shift types with star…	Scheduling / Configuration	Medium	Internal
REQ-008	Manual shift assignment: create, update, delete sh…	Scheduling / Operations	High	Confidential
REQ-009	Shift status lifecycle and tracking (SCHEDULED, CO…	Scheduling / Audit & Reporting	Medium	Confidential
REQ-010	Calendar view with shift preview, search, filterin…	User Interface / Scheduling	Low	Internal
REQ-011	Automated shift assignment via external solver API…	Optimization / Integration	High	Confidential
REQ-012	Asynchronous job processing for optimization reque…	Integration / System Operations	Medium	Internal
REQ-013	Solution scoring (hard/soft constraint metrics), c…	Optimization / Reporting	Medium	Internal
REQ-014	Validation to prevent duplicate shifts across the …	Scheduling / Data Integrity	High	Confidential
REQ-015	Employee shift preferences management with date-sp…	Scheduling / Preferences	Medium	Confidential
REQ-016	Unavailable dates and leave management (SICK_LEAVE…	Scheduling / HR Data	High	Restricted
REQ-017	Skill management: CRUD for skills, skills associat…	Scheduling / Workforce Management	Low	Internal
REQ-018	Data export in CSV and XLSX for entities: shifts, …	Data Management / Reporting	High	Confidential
REQ-019	External API integration with Timefold solver: sec…	Integration / Security	High	Confidential
REQ-020	Internationalization: multi-language support for U…	User Experience / Localization	Low	Public
REQ-021	User interface capabilities: responsive sidebar na…	User Interface / Usability	Low	Public
REQ-022	Audit logging and notifications: record critical o…	Security / Compliance	High	Internal
REQ-023	Legal and privacy: present Privacy Policy, Terms o…	Compliance / Legal	High	Restricted
REQ-024	Operational controls: per-tenant configuration, ra…	Operations / Reliability	Medium	Internal
REQ-025	Data protection controls: encryption at rest and i…	Security / Data Protection	High	Restricted

2.3. Security Context and Regulatory Obligations

Applicable regulations and standards likely include GDPR (EU personal data processing, data subject rights, data transfers), CCPA/CPRA (California consumer privacy), regional data protection laws (vary by tenant), SOC 2/ISO 27001 for operational security and controls, and data minimization principles. OAuth best practices (RFCs), secure API communication (TLS), and proper handling of PII are required. If handling health-related leave data, consider additional jurisdictional protections for health data (e.g., extra safeguards though HIPAA applies only to covered entities). Accessibility (WCAG) and local labor laws for scheduling/worker rights may impose functional constraints. Logging and retention policies must meet legal and audit requirements.

2.4. Assumptions

System will be cloud-hosted (managed cloud provider) with support for multi-region deployment as needed for data residency requirements
Users have reliable internet access and modern browsers; mobile/responsive web is required
External solver (Timefold) provides authenticated HTTPS API endpoints and supports async job model and secure callbacks or polling
Email delivery service (transactional email) is available for verification and notifications
Each company tenant has at least one Admin account to manage tenant-level configuration
Tenants may have different locale/timezone requirements and will be configurable
Data export consumers are authorized by role-based permissions; exports are subject to auditing
No out-of-band HR/Payroll system integration is mandated in the initial scope (can be added later)
System will maintain audit logs for a configurable retention period
Encryption keys and secrets will be centrally managed (e.g., KMS/Secrets Manager)

2.5. Constraints

Must integrate with external Timefold solver API; optimization workflows constrained by solver API capabilities, rate limits, and availability
Asynchronous processing and polling required for long-running optimization tasks; UI must handle partial/ongoing states
Multi-tenant logical separation required; single code-base must enforce per-tenant scoping for data and operations
Support for CSV and XLSX export formats; exports may be large and must be streamed and rate-limited
Compliance constraints (GDPR/CCPA) may impose data residency, deletion, and consent functionality
Third-party auth (Google OAuth) requires configuration per tenant or global consent; fallback credential auth must exist
Performance: schedule optimization and large tenant datasets demand efficient pagination, indexing, and caching strategies
UI responsiveness and calendar rendering must scale to large numbers of shifts and users
Operational monitoring and alerting required for background jobs, external API failures, and integration errors
Retention and archival policies for audit logs, exports, and optimization artifacts must be defined to meet legal/audit needs

3. Stakeholder Analysis

This section identifies and analyzes all stakeholders involved in or affected by the system, including users, administrators, external partners, and regulatory bodies. Stakeholder analysis establishes trust boundaries, defines security responsibilities, and identifies potential security concerns from different stakeholder perspectives. Understanding stakeholder relationships and trust boundaries is critical for designing appropriate access controls, authentication mechanisms, and data protection measures.

3.1. Identified Stakeholders and User Personas

Role	Privilege Level	Trust Level	Key Security Concerns
Admin	Admin	Trusted	Privilege escalation by malicious insiders, unauthorized access to sensitive company data, accidental data deletion.
Manager	User	Partially Trusted	Mismanagement of employee shifts leading to operational risks, unauthorized access to employee data outside their company.
Employee	User	Partially Trusted	Unauthorized shift assignments, exposure of personal data, potential manipulation of preferred shifts.
External Optimization API	Service Account	Untrusted	Insecure API integration potentially exposing sensitive shift and employee data, lack of proper authentication mechanisms.
Email Service Provider	Service Account	Untrusted	Phishing attacks targeting user credentials, data interception during communication.
Monitoring and Logging Service	Service Account	Trusted	Data integrity risks in logs, unauthorized access to monitoring data which could expose system weaknesses.
CDN/WAF	Service Account	Trusted	DDoS attacks targeting application availability, improper configuration leading to data exposure.

3.2. Trust Model

Trust boundaries are established at the user interface, backend server, and database levels. Security mechanisms enforcing these boundaries include user authentication methods (email/password and Google OAuth), role-based access control (RBAC) to ensure users can only access data and functionalities pertinent to their roles, and network segmentation to mitigate risks of unauthorized access. Admins have comprehensive management functions, including user and company management, while Managers can only manage employees within their designated company. Employees can only view and manage their shifts and personal data. External APIs, such as the optimization solver, have restricted access to necessary data only and are monitored closely. The principle of least privilege is implemented by granting users the minimum access necessary to perform their responsibilities, thereby reducing the risk of data exposure and privilege escalation.

4. System Architecture Analysis

4.1. Architectural Overview

A cloud-hosted, multi-tenant web application with a responsive single-page frontend, an API gateway and backend application services that implement authentication, RBAC, scheduling logic, and optimization orchestration, a data tier for multi-tenant relational storage plus caches and object storage for exports/artifacts, and integrations to external services (email, Google OAuth, Timefold solver, monitoring). Users access the SPA via CDN/WAF; the frontend calls the API Gateway which forwards to core API services. The Optimizer component orchestrates asynchronous jobs and communicates with the Timefold solver; results are scored, validated, previewed, and committed to the primary database. Audit, monitoring, and export artifacts are retained in object storage and logs.

4.2. Architecture Diagram

4.3. Component Breakdown

Component	Responsibility	Security Criticality	External Dependencies
Frontend Layer	Serve SPA and admin UI, render calendars…	Medium	CDN/WAF, Google OAuth
Edge Layer (CDN & API Gateway)	Provide DDoS protection, TLS termination…	High	Managed CDN/WAF provider, API Gateway service
Application Services	Core business logic: authentication/auth…	Critical	Google OAuth, Timefold solver
Data Layer	Persist multi-tenant relational data, ca…	Critical	Managed RDBMS, Managed Redis
External Services	Third-party integrations for identity, e…	High	Google OAuth Provider, Email Delivery Provider

4.4. Data Flow Analysis

Users fetch the SPA via CDN and interact with the UI which calls backend APIs through the API Gateway. The API authenticates requests via the Auth service (JWT/OAuth flows), applies RBAC and company scoping, and reads/writes data to the primary RDBMS. Caches (Redis) accelerate reads and sessions. Optimization requests are queued by the Optimizer, a job is created and a payload sent (securely) to Timefold; the external solver returns a solution ID and results which are polled/ingested, scored, validated, and persisted to the DB and object storage as preview artifacts. Notifications and export jobs generate artifacts in object storage and trigger audit log entries. Monitoring and audit logs stream to external observability services.

4.5. Attack Surface Analysis

Primary entry points: public SPA and REST/WebSocket APIs via API Gateway, OAuth endpoints, email links for account verification and password resets, file export endpoints, and the async optimizer integration. Risk levels: API endpoints (High) due to sensitive operations and multi-tenant data access — mitigate with strict RBAC, per-tenant scoping, input validation, rate limits, and WAF; Auth and OAuth flows (High) — protect with secure token handling, PKCE where applicable, brute-force protections, and short-lived JWTs; Optimization integration (Medium-High) — external solver communications must use signed, minimized payloads, strict validation of returned solutions, and sandboxed parsing to prevent injection; Export and object storage endpoints (High) — protect with pre-signed URLs, access logging, role-based export permissions, and streaming/virus scanning for uploads; Email links (Medium) — use tokenized single-use links, expiration, and rate limiting to prevent account takeover; Admin consoles and tenant management (High) — require MFA and IP restrictions. Monitoring and alerting should surface anomalous patterns (failed logins, excessive export use, unexpected optimization results). Regular threat modeling, pen testing, and dependency vulnerability scanning are recommended.

5. Threat Modeling

This section presents a comprehensive threat analysis of the system architecture and functional requirements. Threat modeling systematically identifies potential security vulnerabilities and attack vectors, enabling proactive risk mitigation through the application of appropriate security controls.

5.1. Threat Modeling Methodology

This analysis employs the STRIDE threat modeling methodology, a systematic framework developed by Microsoft for identifying security threats across six categories:

Spoofing Identity: Threats involving impersonation of users or systems
Tampering with Data: Threats involving unauthorized modification of data or system components
Repudiation: Threats where users deny performing actions (lack of non-repudiation)
Information Disclosure: Threats involving unauthorized access to sensitive information
Denial of Service: Threats causing disruption or unavailability of system services
Elevation of Privilege: Threats allowing unauthorized access to privileged functions

For each identified threat, the analysis evaluates likelihood (attack complexity and exposure) and impact (potential damage to confidentiality, integrity, or availability) to determine overall risk level. The methodology ensures comprehensive coverage of security concerns across all system components and interfaces.

5.2. Threat Analysis and Risk Assessment

5.2.1. Threat Overview

The following table provides a quick reference of all identified threats. Detailed analysis including descriptions, mitigation strategies, and residual risk assessment (where available) is provided in the section below.

Threat ID	Component	Category	Risk Level	Likelihood	Impact
THR-001	Frontend Layer (SPA) - Calendar & Tables	Information Disclosure / Spoofing	Critical	High	High
THR-008	Application Services - Authentication	Spoofing	Critical	High	High
THR-003	Frontend Layer (Token Handling)	Spoofing / Information Disclosure	High	Medium	High
THR-004	Frontend Layer / External Services (Google OAuth)	Spoofing	High	Medium	High
THR-005	Edge Layer (CDN/WAF/TLS)	Information Disclosure / Tampering	High	Medium	High
THR-006	Edge Layer (WAF & API Gateway)	Tampering / Information Disclosure	High	Medium	High
THR-009	Application Services - Password Reset	Spoofing / Repudiation	High	Medium	High
THR-010	Application Services - OAuth Integration	Spoofing	High	Medium	High
THR-011	Application Services - RBAC / Multi-tenant Checks	Elevation of Privilege	High	Medium	High
THR-012	Application Services - Multi-Tenancy	Information Disclosure / Tampering	High	Medium	High
THR-013	Application Services - Shift APIs / DB Layer	Tampering (Injection)	High	Medium	High
THR-014	Auto-Assignment (Optimizer Orchestration)	Tampering / Integrity	High	Medium	High
THR-016	Application Services - Audit & Logging	Repudiation	High	Medium	High
THR-017	Data Layer - Object Storage (Exports/Artifacts)	Information Disclosure	High	Medium	High
THR-018	Data Layer - Managed RDBMS	Information Disclosure	High	Medium	High
THR-020	Data Layer - Cache/Session Store (Redis)	Spoofing / Information Disclosure	High	Medium	High
THR-021	External Services - Timefold Solver Integration	Information Disclosure / Tampering	High	Medium	High
THR-022	External Services - Timefold Solver / Solver Responses	Tampering / Elevation of Privilege	High	Medium	High
THR-023	External Services - Email Delivery Provider	Information Disclosure / Repudiation	High	Medium	High
THR-024	External Services - Google OAuth Provider	Spoofing	High	Medium	High
THR-030	User Interface (Cookies / Session)	Elevation of Privilege	High	Medium	High
THR-002	Frontend Layer & Application Services (Forms & Actions)	Tampering (CSRF)	Medium	Medium	Medium
THR-007	Edge Layer (Rate Limiting)	Denial of Service	Medium	Medium	Medium
THR-015	Application Services - Background Jobs / Queue	Denial of Service / Tampering	Medium	Medium	Medium
THR-019	Data Layer - Backups & Export Files	Information Disclosure	Medium	Medium	Medium
THR-025	External Services - Monitoring & Logging	Information Disclosure	Medium	Medium	Medium
THR-026	Data Export Feature (CSV/XLSX)	Tampering / Information Disclosure	Medium	Medium	Medium
THR-027	Auto-Assignment (Concurrency)	Tampering / Denial of Service	Medium	Medium	Medium
THR-028	API Gateway / Frontend Polling (Optimizer Polling)	Denial of Service	Medium	Medium	Medium
THR-029	Internationalization / Date-Time Handling	Tampering / Information Disclosure	Medium	Medium	Medium

Total Threats Identified: 30

5.2.2. Detailed Threat Analysis

This section provides comprehensive analysis of each identified threat, including descriptions, mitigation strategies, and residual risk assessment (where controls have been evaluated). Threats are organized by risk level for prioritized review.

Critical Risk Threats

THR-001 - Frontend Layer (SPA) - Calendar & Tables

Category: Information Disclosure / Spoofing
Likelihood: High | Impact: High
Initial Risk Level: Critical
Description: Reflected or stored XSS in UI (calendar, shift preview, user profile) allows an attacker to run JS in another user’s session, exfiltrate session tokens, hijack accounts, or perform actions on behalf of the user.
Mitigation Strategy: Enforce output encoding/escaping on all user-supplied content; use a strict Content Security Policy (CSP) with nonces; sanitize inputs server-side and client-side, avoid innerHTML; use frameworks’ safe templating; review third-party libs; run regular automated and manual XSS testing (DAST/SAST).

THR-008 - Application Services - Authentication

Category: Spoofing
Likelihood: High | Impact: High
Initial Risk Level: Critical
Description: Credential stuffing, weak passwords, or lack of MFA leads to account takeover of ADMIN/MANAGER accounts allowing large-scale damage.
Mitigation Strategy: Enforce strong password policies, rate-limit authentication attempts, use account lockouts or adaptive throttling, require MFA for privileged roles, integrate breached-password checks and anomaly detection, encourage SSO (Google) with secure config.

High Risk Threats

THR-003 - Frontend Layer (Token Handling)

Category: Spoofing / Information Disclosure
Likelihood: Medium | Impact: High
Initial Risk Level: High
Description: Session tokens or OAuth tokens stored insecurely in localStorage or accessible JS can be stolen via XSS or malicious extensions, enabling account takeover.
Mitigation Strategy: Use secure, httpOnly cookies with SameSite attributes for session tokens; minimize token lifetime; use token rotation and refresh tokens stored securely; implement strong CSP and XSS mitigations; detect anomalous sessions and revoke tokens.

THR-004 - Frontend Layer / External Services (Google OAuth)

Category: Spoofing
Likelihood: Medium | Impact: High
Initial Risk Level: High
Description: Open redirect or incorrect OAuth redirect URI validation allows attackers to capture authorization codes or tokens via a malicious callback, leading to account takeover.
Mitigation Strategy: Strictly validate redirect_uris against allowlist; use PKCE for OAuth flows; verify state parameter and nonce; enforce HTTPS on callback URIs; monitor for abnormal OAuth grant patterns.

THR-005 - Edge Layer (CDN/WAF/TLS)

Category: Information Disclosure / Tampering
Likelihood: Medium | Impact: High
Initial Risk Level: High
Description: TLS termination or CDN misconfiguration (weak ciphers, expired certs, missing HSTS) could allow MitM, protocol downgrade, or data interception between clients and edge.
Mitigation Strategy: Enforce strong TLS configuration (TLS1.2+ recommended, prefer 1.3), HSTS, secure certificate lifecycle management, automate renewals, monitor TLS telemetry, enable HTTP Strict Transport Security, and perform periodic TLS scans.

THR-006 - Edge Layer (WAF & API Gateway)

Category: Tampering / Information Disclosure
Likelihood: Medium | Impact: High
Initial Risk Level: High
Description: WAF rule bypass or insufficient WAF rules allow injection payloads (SQLi, XSS) to reach backend; misconfigured gateway could leak internal details via verbose errors.
Mitigation Strategy: Implement layered WAF rules including OWASP top 10 protections; use positive allowlists for APIs; sanitize error messages; enable anomaly detection and tuning; use gateway-level request validation and schema checks.

THR-009 - Application Services - Password Reset

Category: Spoofing / Repudiation
Likelihood: Medium | Impact: High
Initial Risk Level: High
Description: Weak or predictable password reset tokens, or emails sent with insufficient verification, allow attackers to reset passwords and take over accounts.
Mitigation Strategy: Use long, cryptographically secure, single-use tokens with short TTL; bind token to user agent/IP metadata; log and notify users of resets; rate limit reset requests; verify identity for high-privilege resets; avoid leaking account existence info.

THR-010 - Application Services - OAuth Integration

Category: Spoofing
Likelihood: Medium | Impact: High
Initial Risk Level: High
Description: Compromised or replayed OAuth tokens from Google OAuth could be used to impersonate users if token validation is insufficient.
Mitigation Strategy: Validate ID token signatures and claims server-side; check token expiry and audience; implement token revocation and rotation; use PKCE and state parameters; map OAuth identities carefully to internal accounts with additional checks for privileged ops.

THR-011 - Application Services - RBAC / Multi-tenant Checks

Category: Elevation of Privilege
Likelihood: Medium | Impact: High
Initial Risk Level: High
Description: Broken access control or insufficient tenant scoping may allow a manager/admin/employee to view or modify data for other companies or elevate privileges.
Mitigation Strategy: Implement centralized, fine-grained RBAC and tenant authorization checks on the server side (deny-by-default); perform authorization at every entry point; use automated tests for tenant isolation; include ABAC claims (tenant_id, role) in tokens and validate them server-side.

THR-012 - Application Services - Multi-Tenancy

Category: Information Disclosure / Tampering
Likelihood: Medium | Impact: High
Initial Risk Level: High
Description: Data leakage across tenants due to incorrect SQL queries, shared caches, or improper tenant-scoped identifiers could expose PII and shift data of other companies.
Mitigation Strategy: Use strict tenant_id scoping in queries, prepared statements, row-level security or separate schemas per tenant if appropriate; segregate caches (prefix keys by tenant_id), encrypt data at rest, review multi-tenant design in threat model.

THR-013 - Application Services - Shift APIs / DB Layer

Category: Tampering (Injection)
Likelihood: Medium | Impact: High
Initial Risk Level: High
Description: SQL injection, NoSQL injection or command injection via poorly validated parameters (search, filtering, sorting) could lead to data theft or corruption.
Mitigation Strategy: Use parameterized queries/ORMs, input validation and canonicalization, allowlist sorting/filtering fields, use least privilege DB accounts, run SAST and SQLi testing, employ web application firewall rules tailored to injections.

THR-014 - Auto-Assignment (Optimizer Orchestration)

Category: Tampering / Integrity
Likelihood: Medium | Impact: High
Initial Risk Level: High
Description: An attacker could manipulate optimization payloads, acceptance flow, or solver responses (malformed or malicious solution) to force incorrect assignments (e.g., assign unauthorized employees to shifts) or bypass constraints.
Mitigation Strategy: Sign and validate payloads and responses; use mutual TLS or API keys with IP allowlisting for Timefold; validate solver results against business rules server-side; sandbox and review solutions; require manager approval for critical changes; maintain an immutable audit trail.

THR-016 - Application Services - Audit & Logging

Category: Repudiation
Likelihood: Medium | Impact: High
Initial Risk Level: High
Description: Insufficient or tamperable audit logs allow malicious actors to erase traces of actions (shift changes, acceptance) or administrators to repudiate actions.
Mitigation Strategy: Append-only audit logs, write to immutable storage or WORM-enabled object storage, centralize logs to a managed SIEM, sign or hash log entries, restrict log access, and monitor for log deletion events.

THR-017 - Data Layer - Object Storage (Exports/Artifacts)

Category: Information Disclosure
Likelihood: Medium | Impact: High
Initial Risk Level: High
Description: Misconfigured S3-like buckets or signed URLs with overly long TTLs could leak CSV/XLSX exports or optimizer artifacts publicly, exposing PII and shift data.
Mitigation Strategy: Enforce bucket policies denying public access, use short-lived signed URLs, server-side access control by tenant, encrypt objects at rest, log and monitor object access, and scan object buckets for public exposure.

THR-018 - Data Layer - Managed RDBMS

Category: Information Disclosure
Likelihood: Medium | Impact: High
Initial Risk Level: High
Description: Database credentials stored insecurely (in code, misconfigured secrets management) or overly-permissive DB accounts allow attackers or insiders to dump tenant data.
Mitigation Strategy: Use managed secrets (KMS/Secret Manager), rotate credentials regularly, enforce least privilege DB roles, network isolate DB (VPC), enable encryption at rest, enable DB auditing, and use IAM-based auth where available.

THR-020 - Data Layer - Cache/Session Store (Redis)

Category: Spoofing / Information Disclosure
Likelihood: Medium | Impact: High
Initial Risk Level: High
Description: Compromise of cache/session store could allow theft of session tokens or tenant-scoped cached data, enabling session hijacking or data leakage.
Mitigation Strategy: Network-restrict access to cache (VPC security groups), enable AUTH and TLS on Redis, do not store long-lived secrets in cache, rotate session tokens and invalidate sessions on suspicious activity, isolate keys per tenant, and monitor access.

THR-021 - External Services - Timefold Solver Integration

Category: Information Disclosure / Tampering
Likelihood: Medium | Impact: High
Initial Risk Level: High
Description: Sensitive optimization payloads (employee availability, leave, skills) transmitted to or stored by the external solver may be exposed if the external service is compromised or communication is intercepted.
Mitigation Strategy: Minimize sensitive data sent to external solver; use strong transport security (mTLS), enable payload encryption where possible, contractually require security controls from provider, implement data minimization and anonymization, and maintain an audit of payloads sent.

THR-022 - External Services - Timefold Solver / Solver Responses

Category: Tampering / Elevation of Privilege
Likelihood: Medium | Impact: High
Initial Risk Level: High
Description: Malicious or malformed solver responses could instruct the application to create invalid/privileged assignments or bypass constraints if insufficiently validated.
Mitigation Strategy: Validate solver outputs against server-side business rules and constraints before applying; require manager acceptance for significant changes; verify score integrity; sandbox parsing logic and implement strict schema validation for responses.

THR-023 - External Services - Email Delivery Provider

Category: Information Disclosure / Repudiation
Likelihood: Medium | Impact: High
Initial Risk Level: High
Description: Compromised email provider or mis-sent transactional emails (password resets, verification) can be used for phishing or account takeover or accidental leakage of PII.
Mitigation Strategy: Use a reputable provider with security SLAs; sign emails (DKIM/SPF/DMARC), limit PII in emails, use templated safe content, rate-limit mass emails, monitor bounce/reputation, and provide out-of-band verification for critical operations.

THR-024 - External Services - Google OAuth Provider

Category: Spoofing
Likelihood: Medium | Impact: High
Initial Risk Level: High
Description: Compromise of Google OAuth accounts or misconfiguration (improperly mapped accounts) allowing attackers to authenticate as other users or link accounts incorrectly.
Mitigation Strategy: Implement verification steps when linking OAuth accounts; check verified email claims; require additional verification for privileged role assignment; detect and alert on suspicious OAuth logins (new IP/geo), and support account unlinking and emergency access removal.

THR-030 - User Interface (Cookies / Session)

Category: Elevation of Privilege
Likelihood: Medium | Impact: High
Initial Risk Level: High
Description: XSS or insecure cookie settings allow session cookie theft leading to privilege escalation (e.g., attacker operates as manager/admin).
Mitigation Strategy: Use httpOnly and Secure cookies with SameSite attributes, rotate sessions on privilege changes, provide session management UI for users, invalidate sessions on suspicious activity, and enforce MFA for privileged actions.

Medium Risk Threats

THR-002 - Frontend Layer & Application Services (Forms & Actions)

Category: Tampering (CSRF)
Likelihood: Medium | Impact: Medium
Initial Risk Level: Medium
Description: Cross-Site Request Forgery: authenticated users could be induced to submit state-changing requests (assignments, accept generated shifts) from another origin.
Mitigation Strategy: Implement anti-CSRF tokens on state-changing endpoints or use SameSite=strict/strictish cookies for session tokens; require explicit user confirmation for risky ops (e.g., commit auto-assignment); validate Origin/Referer headers; use CORS allowlist.

THR-007 - Edge Layer (Rate Limiting)

Category: Denial of Service
Likelihood: Medium | Impact: Medium
Initial Risk Level: Medium
Description: Absence or weak rate limiting allows brute-force, enumeration, or abusive polling (e.g., optimizer polling) causing backend overload or service degradation.
Mitigation Strategy: Apply per-IP, per-user, and per-endpoint rate limits; exponential backoff; CAPTCHAs for suspicious flows (login); token bucket throttling; protect long-polling endpoints with quotas; monitor metrics and alert on spikes.

THR-015 - Application Services - Background Jobs / Queue

Category: Denial of Service / Tampering
Likelihood: Medium | Impact: Medium
Initial Risk Level: Medium
Description: Queue or job system abuse (poisoned jobs, replayed jobs, or malformed payloads) can cause failures in optimizer orchestration, duplicate processing, or resource exhaustion.
Mitigation Strategy: Validate and sanitize queued payloads, enforce max job size and rate limits, implement dead-letter queues and idempotency tokens, use job signing or auth, monitor queue depth and job error rates, and use per-tenant job quotas.

THR-019 - Data Layer - Backups & Export Files

Category: Information Disclosure
Likelihood: Medium | Impact: Medium
Initial Risk Level: Medium
Description: Backups, exported CSV/XLSX, or optimizer artifacts containing PII may be retained insecurely or sent to external systems without encryption, leading to data leakage.
Mitigation Strategy: Encrypt backups and exports at rest and in transit, restrict access to backups, apply retention and deletion policies, sanitize exports (redact sensitive fields when possible), and log export/download events per tenant.

THR-025 - External Services - Monitoring & Logging

Category: Information Disclosure
Likelihood: Medium | Impact: Medium
Initial Risk Level: Medium
Description: Sensitive data (PII, tokens) in logs or monitoring metrics sent to third-party services may leak across organizations or be accessible to unauthorized parties.
Mitigation Strategy: Redact or mask PII/tokens before sending to logs; use sampling and data minimization; restrict access to monitoring dashboards; apply retention policies; use encryption for logs in transit and at rest.

THR-026 - Data Export Feature (CSV/XLSX)

Category: Tampering / Information Disclosure
Likelihood: Medium | Impact: Medium
Initial Risk Level: Medium
Description: Exported spreadsheets containing user-entered fields could include CSV injection (formula injection) or contain sensitive PII unexpectedly; exported files may be downloaded using unsecured links.
Mitigation Strategy: Sanitize cell content (prefix ’ or use safe formatting to avoid formula execution), require authentication to download, use short-lived signed URLs, perform pre-export redaction options, and log export events per user and tenant.

THR-027 - Auto-Assignment (Concurrency)

Category: Tampering / Denial of Service
Likelihood: Medium | Impact: Medium
Initial Risk Level: Medium
Description: Race conditions between auto-assignment job acceptance and manual edits can create duplicate shifts, gaps, or inconsistent state across tenants.
Mitigation Strategy: Use transactional operations, optimistic concurrency control (versioning), idempotency tokens for operations, and perform final validation before commit; provide conflict resolution UI and alerting.

THR-028 - API Gateway / Frontend Polling (Optimizer Polling)

Category: Denial of Service
Likelihood: Medium | Impact: Medium
Initial Risk Level: Medium
Description: Abuse of real-time polling endpoints (frequent polling for optimization status) can overwhelm backend services, increasing costs and causing outages.
Mitigation Strategy: Implement backoff, push mechanisms (WebSockets/Server-Sent Events) with authenticated subscribe, enforce polling rate limits, introduce caching for status, and apply quotas per tenant.

THR-029 - Internationalization / Date-Time Handling

Category: Tampering / Information Disclosure
Likelihood: Medium | Impact: Medium
Initial Risk Level: Medium
Description: Locale and timezone misparsing or injection of malformed locale strings could cause incorrect shift calculations, exposing different tenants’ data or mis-scheduling employees.
Mitigation Strategy: Normalize and validate all locale/timezone inputs against known allowlists, store all times in UTC and render locale-aware only in UI, add unit and integration tests for date conversions, and log unexpected locale values.

Note: Residual risk assessment will be calculated after controls are implemented. Once security controls are implemented, this section will show the effectiveness of controls and the resulting residual risk levels.

5.3. Risk Summary

Critical threats center on authentication/authorization failures, multi-tenant isolation errors, and injection/XSS allowing account takeover or cross-tenant data exposure. Attackers’ primary entry points are the frontend (XSS, token storage), authentication flows (credential stuffing, OAuth misconfig), the API gateway (injection and WAF bypass), and external integrations (Timefold, email, OAuth). The highest-risk items requiring immediate attention are: (1) XSS leading to session theft (THR-001), (2) credential-based account takeover and lack of MFA for privileged roles (THR-008), (3) broken RBAC / tenant isolation allowing cross-tenant access (THR-011/THR-012), (4) SQL/command injection and WAF bypass (THR-013/THR-006), and (5) leakage of exports/optimizer payloads via misconfigured object storage or external services (THR-017/THR-021). Overall posture is medium-to-high risk until core controls are implemented: robust server-side authorization and tenant scoping, secure authentication (MFA, strong password policy, OAuth hardening), comprehensive input validation and encoding (prevent XSS/SQLi), secure token handling, network and secrets hygiene, and strict controls for third-party integrations. Priorities: implement strong RBAC and tenancy enforcement, fix XSS vectors and switch to httpOnly secure cookies, enable MFA, enforce parameterized queries and WAF rules, harden edge TLS and rate limiting, encrypt and restrict access to backups/exports, and secure external solver integrations with mTLS and payload validation. Regular controls to deploy: threat-aware secure coding, SAST/DAST, fuzzing/testing around date/time/locale handling, blue/green deployments with security gating, incident detection/response capabilities, and contractual + technical risk controls for third-party providers.

6. Multi-Standard Security Requirements Mapping

This section maps each functional requirement to specific security controls from multiple industry standards: OWASP Application Security Verification Standard (ASVS), NIST SP 800-53 Rev 5, and ISO 27001:2022. This multi-standard approach provides comprehensive coverage across application-level, enterprise-level, and organizational-level security domains:

OWASP ASVS: Application-level security controls (code, APIs, authentication, session management)
NIST SP 800-53: Enterprise security controls (governance, risk management, incident response)
ISO 27001: Information security management controls (policies, procedures, organizational controls)

Requirements are prioritized based on risk assessment and compliance needs, with controls selected from the most appropriate standard(s) for each requirement type.

6.1. Recommended ASVS Compliance Level

Recommended Level: L2

Level 2: Standard

Recommended for most production applications. Provides comprehensive security coverage suitable for applications handling sensitive data or operating in regulated environments. Includes controls for authentication, authorization, data protection, and secure communications.

The recommendation considers factors such as:

Data sensitivity and classification levels
Regulatory and compliance requirements (GDPR, HIPAA, PCI-DSS, etc.)
Threat landscape and risk assessment from threat modeling
Business criticality and potential impact of security incidents

All security controls referenced in this document align with this recommended compliance level.

6.2. Requirements Mapping

This section maps each high-level requirement to specific security controls from multiple standards (OWASP ASVS, NIST SP 800-53, ISO 27001) with detailed descriptions, relevance explanations, and integration guidance. Controls are grouped by standard for clarity.

6.2.1. REQ-001: User registration with email verification and account lifecycle management

OWASP ASVS Controls

V2.1

Requirement: Verify new user registrations via email or other out-of-band mechanisms to ensure account ownership.

Relevance: Directly addresses the need to confirm user ownership of email accounts during registration and reduces fraudulent account creation. It maps to the verification and lifecycle control aspects of the requirement.

Integration Tips: Implement email confirmation tokens that are single-use and time-limited; require confirmation before enabling privileged features. Tie the verification status to account state in the user lifecycle management flows.

Verification Method: Review implementation of email verification flow, inspect token properties (single-use, expiry), and test account behavior before and after verification.

Level: L1 | Priority: Critical

NIST SP 800-53 Controls

AC-2

Requirement: The organization manages information system accounts, including account creation, enablement, modification, disabling, and removal.

Relevance: Specifies lifecycle operations which map to registration, activation, suspension, and removal of user accounts required by the feature.

Integration Tips: Establish automated workflows and approval steps for account creation and deactivation; maintain authoritative records of account states and reason codes.

Verification Method: Audit account management procedures, review logs of account create/disable/delete events, and verify policy enforcement through test cases.

Priority: Critical

IA-5

Requirement: Manage, distribute, and revoke credentials and authenticators throughout the account lifecycle.

Relevance: Addresses credential issuance and revocation tied to account lifecycle which complements email verification and lifecycle management.

Integration Tips: Implement credential issuance policies, track authenticator provenance, and ensure revocation paths (e.g., when email changes or accounts disabled).

Verification Method: Review credential lifecycle processes, test revocation and re-issuance flows, and inspect logs for authenticator events.

Priority: High

ISO 27001:2022 Controls

A.9.2.1

Requirement: A formal user registration and de-registration process shall be implemented to enable assignment of access rights.

Relevance: Mandates a formal process for onboarding/offboarding which ensures registration ties into access rights and lifecycle.

Integration Tips: Document procedures for registration and de-registration, include steps for verification, approvals, and role assignment during onboarding/offboarding.

Verification Method: Inspect documented procedures and sample records for adherence; validate that de-registration revokes access promptly.

Priority: High

6.2.2. REQ-002: Authentication and single sign-on via credentials and Google OAuth

OWASP ASVS Controls

V2.2

Requirement: Support secure authentication including credential-based and federated authentication (OAuth2, OpenID Connect) with proper validation and token handling.

Relevance: Directly covers secure handling of credential-based login and federated SSO (Google OAuth) required by the requirement.

Integration Tips: Use well-vetted OAuth2/OpenID Connect libraries, validate ID tokens server-side, enforce scopes and claims, and handle token storage securely.

Verification Method: Review OAuth/OIDC implementation, verify token validation, scope restrictions, and perform token replay/forgery tests.

Level: L2 | Priority: Critical

V5.3

Requirement: Ensure tokens are validated, scoped, stored securely, and revoked when necessary for SSO and OAuth use-cases.

Relevance: Covers secure token lifecycle for SSO, ensuring tokens from Google are handled safely and revocable.

Integration Tips: Use secure token storage (HTTP-only cookies or secure token stores), implement token revocation and rotation, and minimize token scopes.

Verification Method: Inspect token storage methods, test revocation and refresh flows, and review scope requests during OAuth handshake.

Level: L2 | Priority: Critical

NIST SP 800-53 Controls

IA-2

Requirement: Identify and authenticate organizational users using authenticators and, where appropriate, federated identity mechanisms.

Relevance: Provides organizational control guidance for authenticating users via both local credentials and federated providers like Google.

Integration Tips: Define acceptable authenticators, document trust relationships with identity providers, and require secure channels for federation.

Verification Method: Examine policies for federated identity, test SSO flows for proper authentication, and verify credential handling meets organizational standards.

Priority: Critical

ISO 27001:2022 Controls

A.9.4.2

Requirement: Secure log-on procedures shall be implemented, where appropriate supporting single sign-on and federated identity.

Relevance: Requires secure log-on procedures and supports SSO, aligning with the need for secure Google OAuth integration.

Integration Tips: Implement SSO with secure session establishment, multi-factor option where required, and maintain centralized session policies.

Verification Method: Validate the log-on workflow, verify session creation after SSO, and review session timeout and logout behavior.

Priority: High

6.2.3. REQ-003: Password reset and account recovery

OWASP ASVS Controls

V2.3

Requirement: Implement secure password reset flows using verified contact channels and protections against account takeover (OTP, expiring tokens, rate limiting).

Relevance: Directly maps to the need for secure password reset flows and protections against abuse or account takeover.

Integration Tips: Use single-use, short-lived reset tokens delivered via verified channels, add rate limiting and anomaly detection on reset attempts.

Verification Method: Test reset flows for token reuse, expiry, and ensure resets require verified contact; perform abuse-case testing.

Level: L1 | Priority: Critical

V5.1

Requirement: Recovery tokens and one-time use links must be single-use, short-lived, and protected against replay attacks.

Relevance: Specifies properties of recovery tokens which mitigate replay and abuse in password reset flows.

Integration Tips: Implement cryptographically-random tokens, mark tokens used after redemption, and expire tokens quickly (e.g., 15 minutes).

Verification Method: Inspect token generation and storage, attempt token replay tests, and verify expiry enforcement.

Level: L2 | Priority: High

NIST SP 800-53 Controls

IA-5 (5)

Requirement: Establish policies and mechanisms for managing password resets and recovery in a manner that resists credential compromise.

Relevance: Provides organizational expectations for secure recovery procedures to reduce risk of credential compromise.

Integration Tips: Document recovery procedures, require multi-step verification for high-risk account changes, and log recovery events for auditing.

Verification Method: Review recovery policies, validate multi-step verification for sensitive accounts, and inspect logs of recovery events.

Priority: High

ISO 27001:2022 Controls

A.9.2.3

Requirement: Ensure controlled management of authentication data and password resets, including policies and procedures.

Relevance: Supports governance over reset and recovery processes to prevent misuse, particularly for privileged accounts.

Integration Tips: Apply stricter reset controls for privileged roles, require manual approvals where appropriate, and log privileged resets.

Verification Method: Review privileged reset controls, sampling of privileged account reset logs, and policy documentation.

Priority: Medium

6.2.4. REQ-004: Role-based access control (ADMIN, MANAGER, EMPLOYEE) and user status management

OWASP ASVS Controls

V4.1

Requirement: Enforce role-based access control with least privilege and separation of duties; implement role checks on both client and server sides.

Relevance: Directly prescribes RBAC enforcement necessary for ADMIN/MANAGER/EMPLOYEE roles and ensures server-side enforcement to prevent privilege escalation.

Integration Tips: Centralize role checks in authorization middleware, enforce least privilege for each role, and prevent client-side-only enforcement.

Verification Method: Review role definitions, test access control enforcement across endpoints for each role, and perform privilege escalation attempts.

Level: L2 | Priority: Critical

NIST SP 800-53 Controls

AC-3

Requirement: Enforce access restrictions and ensure users are granted access only to authorized functions and data.

Relevance: Mandates access enforcement which supports role-based controls and status-based access (active/disabled/suspended).

Integration Tips: Implement centralized access control checks, map roles to permissions, and enforce account status checks before granting access.

Verification Method: Inspect policy-to-implementation mapping, run access matrix tests, and verify that disabled users cannot access resources.

Priority: Critical

AC-2 (3)

Requirement: Automate account status changes (enable/disable) and maintain authoritative account state.

Relevance: Supports user status management by prescribing automation and authoritative state control to prevent orphaned or active-but-disabled accounts.

Integration Tips: Integrate with HR systems for status changes, implement automated disabling for inactivity or termination, and record change reasons.

Verification Method: Audit automation integrations, simulate HR-driven status changes, and verify system enforces new statuses immediately.

Priority: High

ISO 27001:2022 Controls

A.9.1.2

Requirement: An access control policy based on business and security requirements shall be established, documented, and reviewed.

Relevance: Requires documented access control policies to define role responsibilities and status management.

Integration Tips: Create and maintain an access control policy describing roles, permissions, and lifecycle procedures; align with HR onboarding/offboarding.

Verification Method: Review access control policy documentation and interview personnel to confirm implementation.

Priority: High

6.2.5. REQ-005: User profile management and company assignment

OWASP ASVS Controls

V4.6

Requirement: Verify that updates to user profiles and assignments (e.g., company membership) are protected by server-side authorization checks.

Relevance: Directly addresses the need to protect profile updates and company assignments from unauthorized changes.

Integration Tips: Enforce server-side permission checks tied to role and ownership; validate company assignment changes against authoritative sources.

Verification Method: Review code paths for profile update endpoints, perform unauthorized modification tests, and inspect audit logs.

Level: L1 | Priority: High

V1.1

Requirement: Design systems to maintain clear trust boundaries so profile attributes that determine access are authoritative and validated.

Relevance: Ensures profile attributes like company assignment are authoritative and cannot be spoofed to gain access across boundaries.

Integration Tips: Store canonical profile attributes in a trusted service or database, and validate tokens/claims used to assert company membership.

Verification Method: Inspect trust boundary design, review data flow diagrams, and test for attribute spoofing.

Level: L2 | Priority: High

NIST SP 800-53 Controls

AC-6

Requirement: Employ least privilege mechanisms for user profile updates and assignment of organizational attributes.

Relevance: Ensures only authorized personnel or processes can assign users to companies or alter profile attributes, reducing risk of misuse.

Integration Tips: Assign minimal privileges to services and operators that manage profile/company attributes and require approvals for sensitive changes.

Verification Method: Check privilege assignments for profile-management components and test unauthorized assignment attempts.

Priority: High

ISO 27001:2022 Controls

A.9.2.2

Requirement: A formal process for granting and revoking access rights and attributes should be followed, including assignment to organizational units.

Relevance: Requires formal provisioning processes which should include company assignment and profile attribute handling.

Integration Tips: Implement provisioning workflows with approvals and record keeping, and enforce verification of company membership during assignment.

Verification Method: Review provisioning records and test the end-to-end process for correctness and auditability.

Priority: Medium

6.2.6. REQ-006: Company CRUD and multi-tenant scoping of data

OWASP ASVS Controls

V14.1

Requirement: Ensure logical separation of tenant data and enforce access controls to prevent cross-tenant data leakage.

Relevance: Directly addresses multi-tenant scoping and the need to prevent cross-company data access when performing CRUD operations.

Integration Tips: Enforce tenant checks at data access layer and include tenant_id in every query predicate; implement row-level security where possible.

Verification Method: Review data access code, run multi-tenant isolation tests (attempt cross-tenant reads/writes), and inspect database policies.

Level: L2 | Priority: Critical

NIST SP 800-53 Controls

SC-7

Requirement: Implement controls to separate and protect system components and data flows; apply isolation as necessary.

Relevance: Supports the requirement to protect and isolate tenant data by prescribing boundary and isolation controls.

Integration Tips: Segment logical components by tenant boundaries, apply network and access controls for management interfaces, and minimize shared state.

Verification Method: Assess architecture diagrams, test separation of management interfaces, and review network segmentation controls.

Priority: High

AC-6 (10)

Requirement: Apply tenant-specific access restrictions and scoping to limit access to tenant resources.

Relevance: Specifies tailoring of least-privilege controls to tenant-specific resources which is essential for company CRUD scoping.

Integration Tips: Map permissions to tenant-scoped roles, implement enforcement in APIs and DB, and maintain per-tenant admin scopes.

Verification Method: Verify per-tenant role mappings, test scoped permissions, and run negative tests attempting cross-tenant CRUD.

Priority: High

ISO 27001:2022 Controls

A.13.2.1

Requirement: Information transfer and segregation mechanisms should be defined to protect the exchange and separation of information between entities.

Relevance: Requires documented segregation mechanisms relevant to multi-tenant CRUD operations and data transfer between tenants.

Integration Tips: Document transfer policies, implement enforcement controls for inter-tenant transfers, and require approvals for cross-tenant data export.

Verification Method: Review policy documents and sample transfer approvals; test that transfers are blocked or logged when not permitted.

Priority: Medium

6.2.7. REQ-007: Shift type management with time ranges and required skills

OWASP ASVS Controls

V1.3

Requirement: Validate business input (e.g., time ranges, required skills) server-side to prevent logic abuse and ensure data integrity.

Relevance: Protects shift-type definitions from malformed or malicious inputs that could break scheduling logic or grant unauthorized capabilities.

Integration Tips: Implement strict server-side validation for time ranges, enforce constraints (no overlap, valid skill IDs), and canonicalize inputs.

Verification Method: Review validation code, perform fuzzing of time/skill inputs, and check DB for invalid persisted records.

Level: L1 | Priority: High

V6.4

Requirement: Ensure business logic (e.g., required skills per shift type) is enforced server-side and cannot be bypassed by client manipulation.

Relevance: Directly ensures shift-type business rules are enforced server-side to prevent client-side tampering.

Integration Tips: Centralize business rules in service layer, implement tests for rule enforcement, and prevent direct DB writes that bypass logic.

Verification Method: Attempt to bypass rules via direct API/DB calls and validate server rejects inconsistent or unauthorized changes.

Level: L2 | Priority: High

NIST SP 800-53 Controls

SI-10

Requirement: Employ integrity checks and input validation to ensure data consistency and correctness.

Relevance: Ensures integrity of shift-type data and supports detection of tampering or corruption.

Integration Tips: Apply schema validation, integrity checksums where necessary, and enforce business rule validation in services.

Verification Method: Inspect schema validations, run integrity checks in test harness, and verify constraints via unit tests.

Priority: Medium

ISO 27001:2022 Controls

A.12.1.2

Requirement: Changes to systems and data (including configuration of business objects like shift types) should be controlled to preserve integrity.

Relevance: Requires controlled change processes for shift-type configurations to prevent unauthorized or erroneous changes.

Integration Tips: Use controlled deployment/change processes for shift-type schema or rule changes, include review/approval steps for business-impacting changes.

Verification Method: Review change records for shift-type modifications and check that approvals were captured.

Priority: Medium

6.2.8. REQ-008: Manual shift creation, update, deletion, and calendar presentation

OWASP ASVS Controls

V4.4

Requirement: Authorize all modification endpoints and verify checks server-side to prevent unauthorized creation, update, or deletion.

Relevance: Ensures only authorized users can create/update/delete shifts, which is central to manual shift management.

Integration Tips: Protect endpoints via role checks and ownership checks; ensure calendar UI actions invoke server-side authorization.

Verification Method: Test role-based access to create/update/delete endpoints, and attempt unauthorized operations.

Level: L1 | Priority: Critical

NIST SP 800-53 Controls

AU-2

Requirement: Determine and log auditable events including create, modify, delete operations.

Relevance: Records manual shift changes for accountability and incident investigation as required by the feature.

Integration Tips: Log change events with user, timestamp, before/after state and reason; protect logs from tampering.

Verification Method: Review audit logs for shift CRUD events and validate completeness and integrity.

Priority: High

AC-6

Requirement: Restrict modify/delete/create operations to roles with explicit permissions.

Relevance: Supports limiting who may perform manual shift operations to defined roles, reducing misuse risk.

Integration Tips: Map CRUD permissions to ADMIN/MANAGER roles and apply checks in API and UI layers.

Verification Method: Review permission mappings and test that lower-privileged roles cannot modify shifts.

Priority: High

ISO 27001:2022 Controls

A.12.4.1

Requirement: Event logs recording user activities, exceptions, and security events shall be produced and retained.

Relevance: Mandates retaining logs for manual shift operations and UI interactions for compliance and troubleshooting.

Integration Tips: Define retention periods, ensure secure storage, and include calendar-related events as auditable actions.

Verification Method: Inspect logs for the required events, retention configuration, and access controls around logs.

Priority: Medium

6.2.9. REQ-009: Shift status tracking and filtering (SCHEDULED, CONFIRMED, COMPLETED, CANCELLED, NO_SHOW)

OWASP ASVS Controls

V10.1

Requirement: Ensure logs and status transitions are recorded in tamper-resistant logs and integrity-protected storage.

Relevance: Protects the integrity of status history to provide trustworthy records for scheduling outcomes.

Integration Tips: Use append-only logs or secure log storage with integrity checks and restrict log modification privileges.

Verification Method: Inspect log storage protections and attempt to modify logs; verify detection of tamper attempts.

Level: L2 | Priority: High

NIST SP 800-53 Controls

AU-6

Requirement: Regularly review and analyze audit records for indications of unauthorized activity or changes.

Relevance: Encourages review of status transitions to detect unauthorized or anomalous status changes such as NO_SHOW flags being manipulated.

Integration Tips: Log status transitions with actor and context, implement periodic reviews and alerts for unusual patterns.

Verification Method: Review audit processes, sample status transition logs, and ensure alerts are configured for anomalies.

Priority: High

CM-3

Requirement: Control and document changes to system configuration and state transitions.

Relevance: Ensures system state transitions for shift statuses are controlled and documented, preventing unauthorized state changes.

Integration Tips: Treat status transition rules as configuration items, version them, and require approvals for rule changes.

Verification Method: Review change records for status transition rule updates and verify approvals were enforced.

Priority: Medium

ISO 27001:2022 Controls

A.12.4.3

Requirement: Administrator and operator activities, including status changes, should be logged and reviewed.

Relevance: Mandates logging of operator actions affecting shift statuses to maintain accountability.

Integration Tips: Capture operator ID and reason for manual status changes, and include review procedures for sensitive transitions.

Verification Method: Check logs for operator entries and review processes for manual status changes.

Priority: Medium

6.2.10. REQ-010: Automated shift assignment (auto-assignment) via external solver with preview and accept/reject

OWASP ASVS Controls

V13.1

Requirement: Securely integrate with third-party APIs using mutual authentication, input/output validation, and secure error handling.

Relevance: Applies to integrating with external solver for auto-assignment and ensuring previews and accepts/rejects are securely transmitted and validated.

Integration Tips: Use mutual TLS or OAuth for API calls, validate solver responses before applying changes, and implement signed payloads or record hashes for integrity.

Verification Method: Review API authentication configuration, test injection or malformed response handling, and verify server validates solver outputs.

Level: L2 | Priority: Critical

NIST SP 800-53 Controls

SA-9

Requirement: Ensure that external interfaces are secured and that integration with external systems follows organizational policies.

Relevance: Mandates governance around external solver usage and how solver results are accepted into the system.

Integration Tips: Define security requirements in supplier agreements, document expected APIs, and ensure change management for solver integration.

Verification Method: Review supplier contracts, interface security documentation, and test compliance with the defined integration policy.

Priority: High

SC-8

Requirement: Protect the confidentiality and integrity of information during transmission to external services.

Relevance: Ensures solver payloads and returned solutions are transmitted securely to prevent tampering or eavesdropping.

Integration Tips: Use TLS with strong ciphers, enforce certificate validation, and consider payload signing for end-to-end integrity.

Verification Method: Inspect TLS configuration, perform MITM tests, and verify payload signatures if implemented.

Priority: High

ISO 27001:2022 Controls

A.15.1.1

Requirement: Establish controls for supplier relationships including security requirements for shared data and interfaces.

Relevance: Supports contractual and security requirements for using an external solver service for assignments.

Integration Tips: Include SLAs and security requirements in supplier agreements, require proof of secure handling, and define incident responsibilities.

Verification Method: Inspect supplier agreements and evidence of supplier security practices and audits.

Priority: Medium

6.2.11. REQ-011: Real-time asynchronous job processing, polling, and solution status tracking

OWASP ASVS Controls

V14.3

Requirement: Ensure job queues and background processing components enforce authentication, authorization, and message validation.

Relevance: Specifies securing job processing elements to ensure only authorized jobs are enqueued/processed and status updates are validated.

Integration Tips: Authenticate producers/consumers, validate job payloads schema, and authorize status-change operations based on role.

Verification Method: Inspect queue ACLs, test unauthorized enqueue/dequeue attempts, and validate payload schema checks.

Level: L2 | Priority: Critical

NIST SP 800-53 Controls

SC-13

Requirement: Use cryptography to protect data in transit and at rest in asynchronous messaging systems.

Relevance: Secures messages and job payloads in transit and at rest as they move through job queues and polling endpoints.

Integration Tips: Encrypt messages in transit with TLS and at rest with appropriate encryption keys; protect queue access with authentication.

Verification Method: Review encryption configurations for queues and endpoints, and test interception attempts.

Priority: High

SI-7

Requirement: Implement integrity checks for data processed asynchronously to detect tampering or corruption.

Relevance: Ensures the integrity of solutions and job payloads is verifiable during the asynchronous processing lifecycle.

Integration Tips: Include checksums, signatures, or message authentication codes (MACs) on job payloads and verify them before processing.

Verification Method: Inspect integrity verification code paths and attempt to submit tampered payloads to confirm detection.

Priority: High

ISO 27001:2022 Controls

A.12.1.1

Requirement: Operational procedures should define and control background processing and message handling.

Relevance: Mandates documented procedures around real-time job processing and polling operations.

Integration Tips: Document job lifecycle, polling intervals, retry limits, and error handling; include operational runbooks for failures.

Verification Method: Review operational procedures and perform runbook drills to validate behavior.

Priority: Medium

6.2.12. REQ-012: Solution scoring, constraint violation analysis, and reporting

OWASP ASVS Controls

V11.2

Requirement: Log inputs, configuration, and outputs of automated decision algorithms to support auditing and explainability.

Relevance: Directly applies to capturing evidence of scoring and constraint violations for review and dispute resolution.

Integration Tips: Record solver inputs, scoring parameters, and output diffs; store logs securely with access controls for auditors.

Verification Method: Check that algorithmic inputs/outputs are logged and can be correlated to user-visible reports.

Level: L2 | Priority: High

NIST SP 800-53 Controls

PM-22

Requirement: Document and analyze how automated solutions are validated, scored, and how violations are reported.

Relevance: Mandates documentation and governance around automated scoring which supports trustworthy reporting.

Integration Tips: Maintain documentation of scoring methodology, test datasets, and validation results; define reporting formats and owners.

Verification Method: Review documentation and validation artifacts and confirm reporting pipelines produce expected outputs.

Priority: Medium

AU-12

Requirement: Generate audit records for security-relevant events including algorithm outputs and violations.

Relevance: Ensures scoring and violation events are auditable and recorded for security/review purposes.

Integration Tips: Define which scoring events are auditable, include identifiers correlating to inputs, and protect audit logs from tampering.

Verification Method: Inspect audit logs for scoring events and test correlation between algorithm runs and generated logs.

Priority: High

ISO 27001:2022 Controls

A.18.1.4

Requirement: Ensure compliance with regulatory requirements for automated processing and provide documentation for decisions.

Relevance: Ensures scoring and reporting practices comply with privacy and regulatory requirements, especially if personal data influences scores.

Integration Tips: Assess privacy impacts of scoring data, avoid unnecessary personal data in scoring logs, and provide explanations where decisions affect individuals.

Verification Method: Review privacy assessments and validate that logs/reporting exclude unnecessary personal data or are appropriately protected.

Priority: Medium

6.2.13. REQ-013: Shift preferences management (date-specific desired/undesired) and preference tracking

OWASP ASVS Controls

V1.5

Requirement: Design systems to minimize collection of personal data and protect user preferences and privacy.

Relevance: Encourages design choices that limit privacy exposure for preference tracking features.

Integration Tips: Collect only necessary preference attributes, provide user controls to view/edit/delete preferences, and protect data at rest.

Verification Method: Inspect data schemas and UI controls for preference management and test deletion/exports to ensure removal.

Level: L1 | Priority: High

NIST SP 800-53 Controls

PL-4

Requirement: Conduct privacy impact assessments for systems processing personal preferences.

Relevance: Requires assessing privacy risks around storing and using user shift preferences.

Integration Tips: Perform PIA to identify sensitive preferences (e.g., religious holidays) and apply minimization or extra protections as needed.

Verification Method: Provide PIA documentation and evidence of mitigations implemented based on findings.

Priority: Medium

AC-19

Requirement: Protect user attribute data including preferences with appropriate access controls.

Relevance: Ensures preferences are only visible and editable by authorized entities to prevent privacy violations.

Integration Tips: Apply attribute-level ACLs so preferences are scoped to the user or authorized managers; restrict export of sensitive preferences.

Verification Method: Test access to preference records from different roles and verify unauthorized reads are blocked.

Priority: Medium

ISO 27001:2022 Controls

A.18.1.4

Requirement: Ensure compliance with regulatory requirements for automated processing and provide documentation for decisions.

Relevance: Preferences may be personal data; this control ensures processing complies with privacy requirements and is documented.

Integration Tips: Limit retention of preference data, document how preferences are used in automated assignment, and expose preference reports for user review.

Verification Method: Review privacy documentation and confirm preference handling is aligned with policy and retention rules.

Priority: High

6.2.14. REQ-014: Unavailable dates and leave management (multiple leave types, date ranges, reasons)

OWASP ASVS Controls

V1.5

Requirement: Implement privacy-by-design for sensitive employee data, minimizing collection and ensuring secure storage.

Relevance: Reinforces data minimization and secure handling for leave management modules.

Integration Tips: Collect only required fields for leave processing, provide limited retention, and notify users about purpose and retention periods.

Verification Method: Review UI/data collection forms and retention policies; verify secure storage controls in place.

Level: L1 | Priority: Medium

NIST SP 800-53 Controls

PL-4

Requirement: Conduct privacy impact assessments when processing sensitive personal data such as health-related leave.

Relevance: Requires evaluating privacy risks posed by collecting leave reasons and ranges and drives protective controls.

Integration Tips: Conduct PIA focusing on special categories of data, implement minimization, and consider pseudonymization where possible.

Verification Method: Provide PIA output and evidence of mitigations (pseudonymization, restricted access).

Priority: High

MP-6

Requirement: Protect sensitive personal data at rest and in transit, and sanitize when exporting or transferring.

Relevance: Applies to exporting or transferring leave records and ensuring sensitive reasons are sanitized or redacted.

Integration Tips: Encrypt leave records at rest, apply field-level redaction for exports, and limit who can download leave data.

Verification Method: Inspect encryption at rest, review export sanitization routines, and test role-based export restrictions.

Priority: High

ISO 27001:2022 Controls

A.18.1.4

Requirement: Ensure compliance with regulatory requirements for automated processing and provide documentation for decisions.

Relevance: Leave reasons may contain sensitive personal data (e.g., medical reasons); this control ensures privacy compliance for processing and storage.

Integration Tips: Classify leave data sensitivity, apply stricter access controls for medical leave, and document legal bases for processing.

Verification Method: Review data classification, access controls, and privacy handling for leave data.

Priority: Critical

6.2.15. REQ-015: Skills management and skill-based matching for assignments

OWASP ASVS Controls

V4.2

Requirement: Implement and verify attribute-based authorization where access and matching logic relies on user attributes (skills).

Relevance: Ensures matching logic based on skills is enforced and protected from manipulation.

Integration Tips: Centralize attribute evaluation, prevent client-side overrides of attributes, and audit attribute changes.

Verification Method: Attempt to alter skill attributes via API/UI and confirm authorization prevents incorrect matching.

Level: L2 | Priority: High

NIST SP 800-53 Controls

AC-3 (5)

Requirement: Support attribute-based access control when access decisions depend on attributes such as skills.

Relevance: Directly enables using skills as attributes for matching and access decisions in assignment processes.

Integration Tips: Model skills as authoritative attributes, implement ABAC policies for matching, and ensure attribute sources are validated.

Verification Method: Review ABAC policies and test that assignments respect skill attribute constraints.

Priority: High

PM-11

Requirement: Ensure data used for decision making (e.g., skills) is accurate and maintained.

Relevance: Ensures matching results are reliable by mandating data quality controls around skills datasets.

Integration Tips: Implement periodic reviews and validation of skill records and provide user workflows to correct inaccuracies.

Verification Method: Check data quality reports and validation procedures for skill records.

Priority: Medium

ISO 27001:2022 Controls

A.9.2.2

Requirement: Provision access and attributes carefully to ensure accurate assignment of skills and privileges.

Relevance: Requires controlled provisioning of skill attributes so matching is based on trusted data.

Integration Tips: Use administrative workflows for adding/removing skills, record provenance, and require approvals for critical attributes.

Verification Method: Review provisioning logs and sample attribute provenance to ensure correct assignment.

Priority: Medium

6.2.16. REQ-016: Export of data (shifts, users, companies, skills, shift types, preferences, unavailable dates) in CSV/XLSX

OWASP ASVS Controls

V3.9

Requirement: Implement controls and authorization checks on data export features and ensure exported files do not leak sensitive data.

Relevance: Specifies authorization and DLP measures for export functionality requested.

Integration Tips: Require role-based export permissions, log all export operations, and throttle/alert on large exports to prevent exfiltration.

Verification Method: Review export permission mappings, audit logs of exports, and perform attempts to export restricted datasets.

Level: L2 | Priority: High

NIST SP 800-53 Controls

MP-6

Requirement: Protect sensitive data when exporting; sanitize or redact as required before transfer or export.

Relevance: Directly applicable to preventing leakage of sensitive fields during data exports.

Integration Tips: Implement export templates that redact PII or sensitive fields by role, and require explicit authorization for exports containing sensitive data.

Verification Method: Test exports for redaction correctness across roles and ensure sanitized outputs do not expose sensitive data.

Priority: Critical

AC-17

Requirement: Control remote access and transfers including file exports to prevent data exfiltration.

Relevance: Applies to how exported files are transferred or downloaded to user endpoints and helps prevent exfiltration.

Integration Tips: Restrict export downloads to secure channels, enforce endpoint device checks or warn about saving sensitive files, and record provenance.

Verification Method: Test downloads over remote sessions and verify transfer controls are enforced.

Priority: Medium

ISO 27001:2022 Controls

A.8.2.3

Requirement: Procedures for handling and transferring information assets including exports should be implemented.

Relevance: Requires formal handling procedures for exported data assets to ensure protection and accountability.

Integration Tips: Document export procedures, include approval steps for sensitive exports, and archive export copies securely if retained.

Verification Method: Inspect documented procedures and sample approvals for export actions.

Priority: Medium

6.2.17. REQ-017: External API integration with Timefold solver including payload generation and solution parsing

OWASP ASVS Controls

V13.1

Requirement: Securely integrate with third-party APIs using mutual authentication, input/output validation, and secure error handling.

Relevance: Directly addresses securing the Timefold solver integration, verifying payloads, and safely parsing responses.

Integration Tips: Apply strong authentication to the Timefold API, validate all solver responses against schema, and handle errors without exposing internal details.

Verification Method: Inspect API authentication setup, review parsing code for schema validation, and execute malformed response tests.

Level: L2 | Priority: Critical

NIST SP 800-53 Controls

SA-9

Requirement: Ensure that external interfaces are secured and that integration with external systems follows organizational policies.

Relevance: Mandates governance for integrating external solvers and ensuring compliance with internal policies.

Integration Tips: Document integration requirements, include security controls in the acquisition process, and require supplier security attestations.

Verification Method: Review acquisition/integration documentation and evidence of supplier security posture checks.

Priority: High

SC-8

Requirement: Protect the confidentiality and integrity of information during transmission to external services.

Relevance: Ensures payloads and solutions exchanged with Timefold are protected from interception or tampering.

Integration Tips: Use TLS, validate certificates, and consider message signing to ensure end-to-end integrity.

Verification Method: Verify TLS config, perform MITM tests, and validate signature verification if implemented.

Priority: High

ISO 27001:2022 Controls

A.14.2.5

Requirement: Security requirements for development and integration of interfaces should be defined and implemented.

Relevance: Ensures development practices for payload generation and parsing include security requirements to avoid vulnerabilities.

Integration Tips: Define interface contracts, include input/output validation, and perform secure code reviews and testing for parsing logic.

Verification Method: Inspect interface contracts and review secure development artifacts and test results.

Priority: Medium

6.2.18. REQ-018: Internationalization (multi-language UI and localized date/time formatting)

OWASP ASVS Controls

V9.7

Requirement: Properly handle Unicode, normalization, and encoding to prevent injection and XSS vulnerabilities across locales.

Relevance: Directly relevant for multi-language UI and localized date/time handling to avoid injection vectors introduced by locale-specific encodings.

Integration Tips: Normalize and canonicalize text inputs/outputs, apply proper encoding/escaping per output context, and validate locale-specific formats.

Verification Method: Test inputs with various Unicode characters and locale-specific formats to detect XSS or parsing issues.

Level: L2 | Priority: High

V9.1

Requirement: Validate and canonicalize input considering locale-specific encodings and formats.

Relevance: Supports safe handling of user inputs in various languages and formats to prevent logic or parsing errors.

Integration Tips: Implement validators that accept locale-specific formats but convert to canonical representations for processing and storage.

Verification Method: Run locale-specific input validation tests and check canonicalization outputs.

Level: L1 | Priority: Medium

NIST SP 800-53 Controls

SC-17

Requirement: Ensure localized data formats and time/date handling do not weaken security mechanisms and are consistently handled.

Relevance: Ensures localized formatting does not break security checks like signature verification or token expiry calculations.

Integration Tips: Use locale-aware libraries for date/time parsing, store timestamps in canonical format (UTC) internally, and format only at presentation layer.

Verification Method: Review date/time handling code and test across locales for consistent behavior of security-sensitive features.

Priority: Medium

ISO 27001:2022 Controls

A.14.2.5

Requirement: Include security requirements for localized applications and data handling in development.

Relevance: Mandates inclusion of localization security needs in development practices for internationalized UI.

Integration Tips: Include localization security checks in SDLC, perform code reviews focused on encoding/formatting, and update test suites for locales.

Verification Method: Inspect development checklists and localized test cases for security considerations.

Priority: Low

6.2.19. REQ-019: User interface features: responsive navigation, tables with pagination/sorting/filtering, calendar views, alerts/notifications, breadcrumbs

OWASP ASVS Controls

V9.2

Requirement: Encode output and validate input to prevent XSS, especially in tables, filters, and dynamic navigation elements.

Relevance: Directly applies to UI elements which render user-controlled content and are susceptible to XSS and injection attacks.

Integration Tips: Escape/encode user data in the proper HTML/JS context, apply CSP headers, and avoid dangerous innerHTML patterns.

Verification Method: Perform XSS testing across UI components including pagination and dynamic filters.

Level: L1 | Priority: Critical

V5.4

Requirement: Implement CSRF protections for state-changing UI actions like shift creation or accept/reject.

Relevance: Protects UI actions (calendar interactions, form submissions) from CSRF attacks that could create/change shifts.

Integration Tips: Use anti-CSRF tokens for state-modifying requests and validate origin/referrer where appropriate.

Verification Method: Perform CSRF attack simulations against state-changing endpoints and verify tokens are required and validated.

Level: L1 | Priority: High

NIST SP 800-53 Controls

SI-10

Requirement: Validate input and handle errors gracefully to avoid exposing sensitive information in UI components.

Relevance: Encourages sanitizing/filtering user inputs used for sorting/pagination and ensuring error messages do not leak internals.

Integration Tips: Validate query parameters for pagination/sorting on server-side and sanitize user-visible error messages.

Verification Method: Review server-side validation for UI query parameters and inspect error messages for sensitive info.

Priority: High

ISO 27001:2022 Controls

A.12.2.1

Requirement: Apply secure development and application-level controls to mitigate common application threats.

Relevance: Provides general secure development guidance for UI features to reduce vulnerabilities like XSS and CSRF.

Integration Tips: Adopt secure UI development practices, include security tests in CI, and ensure third-party UI libs are vetted.

Verification Method: Check secure development artifacts, dependency scans, and UI security test results.

Priority: Medium

6.3. Cross-Functional Security Controls

The following controls apply globally across all system components:

Logging and Audit Trails

Description: Centralized, tamper-resistant logging of security-relevant events including authentication, authorization changes, exports, consent events, solver interactions, and algorithmic outputs.

Applies to: All requirements (global), Audit logging features, Automated assignment and solver integration, Data export and profile changes

Implementation Guidance: Implement an append-only or integrity-protected logging system (WORM or signed logs), centralize logs with access controls, and define retention and review processes. Ensure logs capture actor, timestamp, action, target resource and before/after states where applicable.

Encryption in Transit and at Rest

Description: Protect sensitive data (credentials, PII, solver payloads, exported files) with strong encryption during transit and at rest.

Applies to: Authentication flows, External API integrations, Asynchronous job payloads, Exported files and sensitive data stores

Implementation Guidance: Use TLS with current best-practice cipher suites for all external and internal communication; encrypt data at rest with managed keys and apply field-level encryption for highly sensitive fields. Rotate keys and manage access to encryption keys via KMS with strict IAM controls.

Input Validation and Output Encoding

Description: Canonicalize, validate and sanitize inputs; encode outputs according to their context to prevent injection (XSS, SQLi) and logic bypass.

Applies to: UI components (tables, filters, calendar), Shift/skill/leave creation and updates, API payloads and external solver responses

Implementation Guidance: Implement server-side canonicalization and validation for all inputs, apply context-aware encoding on outputs, and use schema validation for APIs. Include locale-aware validation for internationalized inputs and test with Unicode edge-cases.

Access Control and Authorization

Description: Centralized enforcement of role-based and attribute-based access controls, with least privilege and tenant scoping.

Applies to: RBAC and user status, Company CRUD/multi-tenant scoping, Profile and assignment management, Export and administrative functions

Implementation Guidance: Use a centralized authorization service or middleware enforcing RBAC/ABAC checks at every API entrypoint, include tenant_id in access decisions, and implement policy management and review processes to keep permissions up-to-date.

Privacy and Data Minimization

Description: Assess and minimize personal data collection (preferences, leave reasons) and protect special categories of data with additional safeguards.

Applies to: Preferences and leave management, Exports and reporting, Algorithmic scoring and solver inputs/outputs

Implementation Guidance: Conduct PIAs for sensitive data, apply pseudonymization or redaction for exports, limit retention periods, and restrict access to need-to-know personnel. Record legal basis and user consent where required.

6.4. Requirements Traceability Overview

This section demonstrates complete traceability from high-level requirements through threats to security controls and verification methods.

Coverage Summary: Traceability matrix contains 25 requirements. 25 requirements (100.0%) linked to threats. 19 requirements (76.0%) mapped to security controls (OWASP ASVS, NIST SP 800-53, ISO 27001). Coverage: Partial.

Sample Traceability Mappings

The following table shows traceability for high-priority requirements:

Req ID	Requirement	Threats	Security Controls	Standards	Priority	Verification
REQ-001	User registration with email verificatio…	10 threats	4 controls	ISO27001, NIST, OWASP	Critical	Review implementation of email verification flow, inspect token properties (single-use, expiry), and test account behavior before and after verification.
REQ-002	Authentication supporting credentials-ba…	5 threats	4 controls	ISO27001, NIST, OWASP	Critical	Examine policies for federated identity, test SSO flows for proper authentication, and verify credential handling meets organizational standards.
REQ-003	Password reset and account recovery flow…	10 threats	4 controls	ISO27001, NIST, OWASP	Critical	Review recovery policies, validate multi-step verification for sensitive accounts, and inspect logs of recovery events.
REQ-004	Role-based access control (ADMIN, MANAGE…	10 threats	4 controls	ISO27001, NIST, OWASP	Critical	Audit automation integrations, simulate HR-driven status changes, and verify system enforces new statuses immediately.
REQ-006	Admin-only company CRUD and multi-tenant…	10 threats	4 controls	ISO27001, NIST, OWASP	Critical	Review data access code, run multi-tenant isolation tests (attempt cross-tenant reads/writes), and inspect database policies.
REQ-008	Manual shift assignment: create, update,…	10 threats	4 controls	ISO27001, NIST, OWASP	Critical	Inspect logs for the required events, retention configuration, and access controls around logs.
REQ-011	Automated shift assignment via external …	10 threats	4 controls	ISO27001, NIST, OWASP	Critical	Inspect TLS configuration, perform MITM tests, and verify payload signatures if implemented.
REQ-012	Asynchronous job processing for optimiza…	4 threats	4 controls	ISO27001, NIST, OWASP	Critical	Inspect integrity verification code paths and attempt to submit tampered payloads to confirm detection.
REQ-016	Unavailable dates and leave management (…	8 threats	4 controls	ISO27001, NIST, OWASP	Critical	Review data classification, access controls, and privacy handling for leave data.
REQ-018	Data export in CSV and XLSX for entities…	10 threats	4 controls	ISO27001, NIST, OWASP	Critical	Review data classification, access controls, and privacy handling for leave data.

Showing 10 of 25 requirements. See Appendix D for complete traceability matrix.

Traceability Statistics

Total Requirements Tracked: 25
Requirements Linked to Threats: 25 (100.0%)
Requirements Mapped to Controls: 19 (76.0%)
Average Controls per Requirement: 3.0
Control Distribution by Standard:
- NIST SP 800-53: 33 controls
- OWASP ASVS: 24 controls
- ISO 27001: 19 controls
Verification Coverage: 100% (all requirements have verification methods)

7. AI/ML Security Requirements

This section addresses security requirements specific to artificial intelligence and machine learning components within the system. AI/ML systems introduce unique security challenges including prompt injection attacks, data poisoning, model theft, adversarial inputs, and bias vulnerabilities. This analysis identifies AI/ML components, assesses their security risks, and prescribes specialized controls to protect both the AI systems themselves and the data they process.

7.1. AI/ML Components Detected

This section identifies all AI/ML components within the system that require specialized security controls.

Automated Shift Assignment: Utilizes an external optimization solver (Timefold) to automate shift assignment based on constraints and user preferences.
Optimization Scoring and Reporting: Analyzes and scores generated shift assignments based on hard and soft constraints, providing feedback on constraint violations.

7.2. AI/ML Threat Model

Component	Identified Threats
Automated Shift Assignment	- Prompt injection
	- Data leakage (sensitive user information in prompts)
	- Model poisoning (manipulating the optimization algorithm)
	- Adversarial inputs (crafting inputs to yield biased outputs)
Optimization Scoring and Reporting	- Data leakage (exposing sensitive data in scoring feedback)
	- Model inversion attacks (extracting training data from model output)

7.3. AI/ML Security Controls

Automated Shift Assignment

Prompt Injection Prevention: Implement strict input validation to ensure that inputs to the external solver do not contain malicious commands or unexpected data formats.
Input Validation for AI Inputs: Validate all user inputs against a predefined schema to prevent injection attacks.
Output Filtering and Sanitization: Sanitize outputs from the optimization solver to ensure that no sensitive data is leaked in the response.
Data Leakage Prevention: Use encryption to protect sensitive user data that might be included in prompts sent to the external solver.
Model Access Controls: Restrict access to the optimization API to authorized users and services only.
Rate Limiting and Abuse Prevention: Implement rate limiting on requests to the external solver to prevent abuse and denial-of-service attacks.

Optimization Scoring and Reporting

Monitoring for Adversarial Inputs: Set up monitoring to detect unusual patterns in scoring requests that might indicate adversarial behavior.
Model Versioning and Rollback Capabilities: Maintain version control of the optimization model to allow quick rollbacks to previous safe versions if vulnerabilities are detected.
Supply Chain Security for Models: Vet and verify the security posture of third-party optimization solver providers.
Bias and Fairness Considerations: Regularly audit the scoring algorithm for fairness and bias, ensuring that outputs do not favor any group over another.

7.4. Integration with Existing Security Controls

AI/ML security controls should be integrated with existing security practices such as role-based access control, secure API management, and regular security audits. The automated shift assignment and scoring components should be monitored as part of the overall application security monitoring strategy, ensuring that standard practices for logging, incident response, and data protection extend to AI/ML functionalities.

7.5. AI/ML Monitoring Requirements

Monitoring Area	Description
Input Validation Logs	Log all inputs sent to the external optimization solver for auditing and anomaly detection.
Output Sanitization Logs	Log outputs received from the optimization solver, ensuring no sensitive information is present.
Access Control Monitoring	Monitor access to the optimization API to detect unauthorized access attempts.
Anomaly Detection for Scoring	Implement anomaly detection on scoring outputs to identify potential adversarial attacks.
Audit Logs	Maintain detailed audit logs for all AI/ML interactions to support investigations and compliance.

8. Compliance Requirements

This section identifies regulatory and legal compliance obligations applicable to the system based on data types, geographic scope, industry sector, and business operations. Compliance requirements drive specific security controls, data handling procedures, audit capabilities, and privacy protections. Non-compliance can result in significant legal penalties, reputational damage, and business disruption. This analysis maps applicable regulations to specific security requirements and operational procedures.

8.1. Applicable Regulations

In analyzing the requirements for the Shift Management System, several regulations were identified based on the nature of the data being processed, the geographic scope of the application, its industry sector, and the business operations involved. The application handles personal information of employees and may also interact with various compliance-sensitive data types, such as health information and payment data. Each regulation identified imposes specific compliance requirements that directly impact the security controls, data handling procedures, and operational processes necessary to ensure legal compliance. Below is a table summarizing the relevant regulations.

Regulation	Applicability Reason
GDPR	Applies because the system processes personal data of EU residents.
CCPA	Applies due to the handling of personal data of California residents.
HIPAA	May apply if the application handles any health-related information of employees.
PCI-DSS	Relevant if any payment card data is processed for employee reimbursements.
SOX	Applies to financial data management and auditing requirements for operational transparency.
GLBA	Applies if the application involves financial information related to employees or companies.
COPPA	Relevant if the application collects data from users under the age of 13.
Data Residency Laws	Applies based on the geographic location of the data storage and processing.

8.2. Compliance Controls by Regulation

CCPA

Provide clear privacy notices to users about data collection and usage.
Implement mechanisms for users to exercise their rights to access, delete, or opt-out of the sale of personal data.
Ensure data security measures are in place to protect personal information.

HIPAA

Establish safeguards for protected health information (PHI).
Implement access controls to limit PHI access to authorized personnel only.
Conduct regular risk assessments and audits related to PHI handling.

PCI-DSS

Use strong encryption methods for storing and transmitting payment card data.
Maintain a secure network by implementing firewalls and anti-virus software.
Regularly monitor and test networks to identify vulnerabilities.

SOX

Implement internal controls for financial reporting and data integrity.
Maintain audit logs for all financial transactions related to employee payments and reimbursements.
Establish regular audits for compliance verification.

GLBA

Develop policies for the protection of nonpublic personal information (NPI).
Implement measures to ensure the confidentiality and security of financial data.
Provide clear privacy notices regarding the sharing of financial information.

COPPA

Implement parental consent mechanisms for users under 13.
Ensure data collection practices are transparent for minor users.

Data Residency Laws

Store and process data in compliance with the local laws of the geographic regions where users reside.
Implement data transfer mechanisms that comply with cross-border data regulations.

8.3. Data Subject Rights

Right	Description
Right to Access	Users can request access to their personal data.
Right to Rectification	Users can request correction of inaccurate data.
Right to Erasure	Users can request deletion of their personal data.
Right to Object	Users can object to the processing of their data.
Right to Data Portability	Users can request their data in a portable format.

8.4. Privacy Requirements

Consent: Users must provide explicit consent for their personal data to be collected and processed.
Privacy Notice: Clear privacy policies must be displayed, outlining data collection, usage, and rights of users.

8.5. Audit and Monitoring Requirements

Logging: Maintain audit logs of user access and data modifications to ensure traceability.
Monitoring: Regularly monitor data access and changes to ensure compliance with regulations.

8.6. Data Handling Rules

Retention: Personal data should be retained only as long as necessary for its intended purpose and must be securely deleted afterward.
Deletion: Implement procedures for the secure deletion of personal data upon request or once data retention periods have expired.

8.7. Compliance Risk Assessment

In assessing the compliance risks associated with the Shift Management System, various key compliance risks have been identified that could impact the organization if not properly managed. These risks can lead to legal penalties, loss of user trust, and reputational damage.

Key Compliance Risks:

Failure to obtain proper consent for personal data processing could result in GDPR and CCPA violations.
Inadequate protection of health information could lead to HIPAA breaches and associated penalties.
Lack of secure handling of payment data could result in PCI-DSS compliance failures, leading to significant fines.
Insufficient auditing and controls over financial data could violate SOX and GLBA requirements, resulting in legal repercussions.

9. Security Architecture Recommendations

This section provides comprehensive security architecture guidance that integrates security controls into the system’s technical design. Security architecture defines how security principles, controls, and patterns are applied across system components to create a cohesive, defense-in-depth security posture. The recommendations address architectural principles, component-level controls, data protection strategies, and third-party integration security to ensure security is built into the system design.

9.1. Architectural Security Principles

Architectural security principles provide the foundational philosophy guiding all security design decisions. These principles ensure a consistent security posture across all system components and guide selection and implementation of controls so the Shift Management System remains resilient, auditable, and privacy-preserving.

Zero Trust Architecture principles: Never trust, always verify — every request, user, and service must be authenticated and authorized regardless of network location; reduces risk from compromised internal networks and enforces fine-grained controls.
Defense in Depth: Deploy multiple layers (network, host, application, data) so that failure of one control does not result in a total compromise; ensures redundancy and detection opportunities at each layer.
Principle of Least Privilege: Grant users, services, and processes only the minimum permissions required to perform tasks; reduces blast radius of compromised accounts or services.
Secure by Default / Secure by Design: Systems are secure out-of-the-box with safe defaults (secure configs, disabled debug endpoints), and security is incorporated throughout the SDLC and architecture.
Separation of Duties: Split responsibilities across roles and systems (e.g., admin vs. operator vs. auditor) to limit fraud and mistakes and to provide checks-and-balances for sensitive actions like accepting solver results or exporting data.
Fail Secure: In failure scenarios default to safe-deny behaviors (e.g., reject unverified solver responses, deny access on auth service failures) to prevent unauthorized operations.
Complete Mediation: Every access to a resource is checked against up-to-date authorization policy (no caching of authorization decisions without revalidation for sensitive operations).
Minimize Attack Surface: Reduce exposed interfaces and services; disable unnecessary features, and limit public endpoints to those required for the SPA/API gateway.
Auditability and Accountability: Design to capture immutable audit trails for security-relevant events (authentication, acceptance of auto-assignment, exports, leave records) with sufficient context for investigations and compliance.
Data Minimization and Privacy-by-Design: Collect and store the minimum personal data necessary; treat leave and preference data as potentially sensitive and apply stronger protections and PIAs.
Cryptographic Best-Practices: Use modern, vetted algorithms, centralized key management, short-lived credentials where possible, and hardware-backed keys (HSM/KMS) for critical secrets.
Resilience and Observability: Instrument system health, security telemetry, and business events to detect misuse and faults quickly and support IR and SLA goals.

9.2. Component-Level Security Controls

Frontend User Interface

Required Controls:

Enforce output encoding and input validation on all user-supplied content.
Implement Content Security Policy (CSP), X-Frame-Options, X-Content-Type-Options, and Referrer-Policy headers.
Use OAuth2/OpenID Connect Authorization Code flow with PKCE for Google sign-in.
Use secure, HttpOnly, SameSite=strict cookies or short-lived access tokens stored in secure browser cookie with CSRF protections.
Implement CSRF protection for all state-changing requests.
Validate and canonicalize locale-specific inputs to defend against injection/XSS through localization.
Prevent sensitive data in localStorage; avoid persisting tokens to client side beyond short-lived needs.
Implement client-side rate-limiting UI protections (to reduce accidental high frequency) and enforce rate limits server-side.
Protect file downloads (exports) with signed, time-limited pre-signed URLs and role checks.

Recommended Patterns:

Serve SPA via CDN with SRI (subresource integrity) and strict TLS enforcement.
WAF in front of static assets to block known web attacks and bot abuse.
Use same-origin policies and secure cookie settings; prefer cookie-based session with anti-CSRF tokens for forms.
Use client-side feature flags with server-side guard for risky features (auto-accept of solver results disabled by default for lower roles).
Implement localization libraries that sanitize and canonicalize input/output.

Edge Layer (CDN & API Gateway)

Required Controls:

TLS termination with TLS1.3 preferred and strong cipher suite; enforce HSTS.
Web Application Firewall (managed rules + custom rules) with OWASP top-10 protections enabled.
DDoS protection and rate limiting per IP and per API key/tenant.
API authentication and token validation at gateway (JWT stateless validation and introspection for opaque tokens).
Geo/IP-based access controls and egress/ingress filtering for management endpoints.
Request size limits and schema validation at gateway for large solver/payload submissions.
Centralized access logging (structured logs), WAF alerts, and request tracing headers (correlation id).

Recommended Patterns:

API Gateway with OAuth2 token validation and JWT introspection and per-tenant quota enforcement.
Use a layered edge model: CDN for static assets + WAF + API Gateway for dynamic endpoints.
mTLS between API gateway and backend application services for internal trust.
Gateway-level response caching for safe-read endpoints and circuit-breaker patterns for external service unavailability.

Application Services

Required Controls:

Centralized Authentication and Authorization service (AuthN/AuthZ) with RBAC + ABAC support; evaluate Open Policy Agent (OPA) for policy enforcement.
Strong password handling: Argon2id (or bcrypt with modern params) with per-user salts; enforce password policy and rate-limit login and reset attempts.
Multi-factor authentication (MFA) option for admins and managers.
Role and tenant scoping enforced server-side on every API (complete mediation).
Input validation and canonicalization for business objects (shifts, times, preference data) and solver payloads.
Audit events for all security-relevant operations (user CRUD, exports, accept/reject solver solution, status changes) with before/after state.
Service-to-service authentication using short-lived tokens and mTLS; secrets stored in KMS/secret manager and rotated automatically.
Background job authorization and validation for queued tasks and solver orchestration; jobs signed and verified.
Strict schema validation and whitelisting for Timefold solver responses; do not auto-commit without operator validation.
Protect endpoints with rate limiting, anomaly detection (excessive changes), and IP reputation checks.

Recommended Patterns:

Microservices architecture with an API Gateway fronting services and a centralized auth service.
Policy engine (OPA) or centralized IAM for RBAC/ABAC decisions integrated into middleware.
Service mesh (e.g., Istio) for mTLS, traffic control, observability, and failure isolation between services.
Use message queue (SQS/RabbitMQ) with encrypted payloads and ACLs for async jobs.
Use signed job payloads and integrity checks (HMAC/JWS) for async job lifecycle.

Data Layer

Required Controls:

Row-level tenant isolation (tenant_id predicate enforced at data layer) or per-tenant schema architecture to prevent cross-tenant access.
Database encryption at rest (TDE) and field-level/envelope encryption for highly sensitive fields (leave reasons, medical data).
Strong DB authentication with IAM/managed identities; no long-lived DB credentials in code.
Backups encrypted, access-controlled, and tested for restoration; backup retention policy aligned to compliance.
Database activity monitoring and audit logs capturing DML operations for sensitive tables.
Prepared statements / ORM parameterization and input validation to prevent SQL injection.
Redis/session cache encrypted in transit and at rest; strict ACLs for caches.

Recommended Patterns:

Managed RDBMS with Transparent Data Encryption + column-level encryption for PII.
Use Row-Level Security (RLS) or mandatory tenant filter middleware to enforce tenant scoping.
VPC-only database access; private subnets and restricted admin bastion with MFA.
Object storage with server-side encryption + customer-managed keys for exported artifacts and solver artifacts.

External Services

Required Controls:

Explicit trust model and contractual SLAs/security requirements for each supplier (Google OAuth, Email provider, Timefold).
Use secure connection models (OAuth2/OpenID Connect with ID token validation; mTLS for solver where supported).
Secrets for external APIs stored and rotated via KMS/secret manager; restrict scopes to least privilege.
End-to-end logging and correlation for requests/responses to/from external services; validate all external responses.
Circuit breakers and retry/backoff policies for external service failures.

Recommended Patterns:

Private connectivity (VPC endpoints, PrivateLink) to external providers where supported to avoid public internet egress.
Use signed payloads (JWS) or message-level integrity checks for solver payloads/results.
Centralized integration gateway for third-party calls with per-integration policies (rate limit, auth, monitoring).

9.3. Data Protection Strategy

Data Classification: Public, Internal, Confidential, Restricted

Public: Non-sensitive static content (marketing copy, CSS, JavaScript) that can be publicly accessible.
Internal: Operational metadata and logs that are not user-identifiable (system metrics, anonymized analytics).
Confidential: User profile data, job metadata, shift assignments (excluding sensitive leave reasons), company records, skills, shift types.
Restricted: Sensitive personal data (leave reasons containing health info, explicit PII like national identifiers), solver payloads that include PII tied to optimization decisions, audit trails containing sensitive context, and exports including PII.

Encryption Requirements:

Data in transit: TLS 1.3 preferred; support TLS 1.2 with strong ciphers (ECDHE with AES-GCM or ChaCha20-Poly1305). Enforce HSTS and disable insecure ciphers and legacy protocols.
Data at rest:
- Use AES-256-GCM for symmetric encryption of databases, object storage, and backups.
- Use envelope encryption with customer-managed keys (CMKs) stored/managed in KMS/HSM.
- Field-level encryption for Restricted fields using AES-256-GCM with keys derived via KMS and, where necessary, additional application-level encryption.
Keys and signatures:
- Use RSA-3072 or ECDSA P-256/P-384 for asymmetric needs; prefer ECC (P-256 or secp384r1) for signatures (e.g., JWS ES256/ES384).
- Password hashing: Argon2id with tuned parameters (memory, iterations) appropriate to platform; store only salted hashes.
- HMAC: Use HMAC-SHA256 or better for integrity checks.
Solver interactions:
- Use mTLS where supported, or OAuth2 Client Credentials with short-lived tokens.
- Consider payload signing (JWS) so solver responses can be verified against known public keys.

Retention Policies:

User account data: Retain active account data while account status is ACTIVE; upon deletion/requested erasure, remove or anonymize within 30 days unless legal hold applies.
Preferences and unavailable dates: Retain for business needs; default retention 2 years unless user requests deletion or longer retention required by employer policies.
Solver artifacts and generated assignments: Keep drafts and solver payloads for 90 days by default for audit/traceability; mark older artifacts for purge or archive to long-term cold storage if needed for compliance (7 years if required by contracts).
Export files: Keep pre-signed export artifacts available for download for 7 days then auto-delete. If a copy is retained server-side (for audit), store in encrypted object storage with limited retention (90 days) unless flagged for longer retention with approval.
Audit logs: Maintain security and audit logs for at least 1 year online and archive for up to 7 years depending on regulatory requirements.
Backups: Encrypted backups retained per organizational recovery objectives (e.g., 30-90 days rotation, archived snapshots per legal requirements).

Handling Procedures:

Access:
- Enforce role-based and attribute-based access controls; require approval/workflow for exports containing Confidential/Restricted data.
- Sensitive fields (Restricted) accessible only to authorized roles and logged with justification.
Transmission:
- All external communications use TLS; prefer private connectivity to external providers.
- For solver payloads, enforce payload signing or HMAC and validate integrity on receipt.
Storage:
- Apply least-privilege IAM for data stores and KMS; restrict access to key usage via IAM policies.
- Implement monitoring and alerting for anomalous accesses (large exports, bulk reads).
Deletion:
- Implement soft-delete with secure permanent deletion policy: soft-delete retention for recoverability (e.g., 30 days) then cryptographic shredding (delete keys and data) or secure wipe per storage provider capabilities.
- For GDPR/CCPA erasure requests: remove personal identifiers and replace with pseudonymous token; purge all backups subject to legal hold exceptions and document actions.
Backups and replication:
- Ensure backups are encrypted and keys rotated; test restore processes.
Export sanitization:
- Redact or pseudonymize sensitive fields in exports by default; create role-based templates for sensitive exports requiring approval and additional logging.
Developer and CI/CD:
- Secrets never in source control. Use ephemeral credentials in CI/CD, secrets manager integration, SCA checks on dependencies, and signing of build artifacts.

9.4. Third-Party Integration Security

Google OAuth (OpenID Connect)

Security Requirements:

Use OAuth2/OpenID Connect Authorization Code flow with PKCE.
Validate ID tokens server-side (aud, iss, exp, nonce).
Restrict redirect URIs to exact values and register app secrets in secrets manager.
Scopes limited to minimum required identity attributes.

Risk Assessment: High — identity provider compromise or misconfiguration can allow account takeovers or impersonation. Incorrect token validation can yield privilege escalation.

Recommended Controls:

Use well-vetted OIDC libraries and perform server-side token validation.
Enforce client secrets and redirect URI restrictions; rotate client secrets periodically.
Map federated identities to internal accounts with tenant-binding checks and do not grant elevated roles without additional verification (e.g., email domain checks and admin approval).
Monitor OAuth events, anomalous sign-ins, and adopt adaptive risk-based controls (MFA for suspicious sessions).

Email Delivery Provider (e.g., SendGrid, SES, Mailgun)

Security Requirements:

Use API keys stored in secrets manager with least privilege.
Enforce TLS for SMTP/API endpoints.
Sign transactional emails via DKIM and SPF configuration for domain.

Risk Assessment: Medium — email is used for verification and password resets; compromise or interception can enable account takeover.

Recommended Controls:

Rotate API keys and restrict inbound/outbound domains.
Rate-limit email sends and monitor for abnormal volumes (spam detection).
Use signed verification links (single-use, short-lived tokens) and monitor bounce/failure rates.

Timefold Optimization Solver

Security Requirements:

mTLS or OAuth2 client credentials for mutual authentication.
Schema validation for solver payloads and responses.
Signed payloads or HMAC to establish integrity/trust between system and solver.

Risk Assessment: High — solver results directly affect schedule and may contain PII; corrupted or malicious responses could create unsafe assignments or data leakage.

Recommended Controls:

Use mTLS or mutually authenticated TLS endpoints; restrict endpoints and IPs via allowlists.
Sign requests (JWS) and require signed responses; validate signatures before allowing preview or commit.
Sandbox parsing and extensive schema validation; treat solver as untrusted until validated.
Keep solver payloads and responses encrypted in transit and at rest; log inputs/outputs for audit with redaction for sensitive fields.

CDN & WAF Provider

Security Requirements:

TLS termination with HTTP security headers support.
Access to management console restricted with MFA and RBAC.
Support for custom WAF rules and real-time logging.

Risk Assessment: High — misconfiguration or provider compromise may expose traffic or bypass protections.

Recommended Controls:

Use least-privileged API keys, restrict management IPs, and enforce MFA for admin management.
Deploy custom WAF rulesets for app patterns and tune with observable logs.
Integrate CDN logs into SOC pipeline for monitoring and incident response.

Object Storage (S3-compatible)

Security Requirements:

Server-side encryption with CMKs and enforce TLS for all transfers.
Bucket policies limiting public access and enforcing VPC endpoints where possible.

Risk Assessment: High — exported artifacts and solver artifacts stored here may contain PII; misconfigured buckets lead to data exposure.

Recommended Controls:

Block public access by default; use pre-signed URLs for downloads and short TTLs.
Enforce bucket-level logging and object lock/WORM for audit archives as appropriate.
Use lifecycle policies to auto-delete artifacts per retention rules.

Queueing/Background Job System (SQS, RabbitMQ)

Security Requirements:

TLS for broker connections; access control lists for producers/consumers.
Message-level encryption and integrity checks for solver payloads.

Risk Assessment: Medium — job tampering or unauthorized enqueuing could trigger unauthorized operations or leak data.

Recommended Controls:

Enforce authentication for producers/consumers and validate job payloads before processing.
Use signed job tokens and schema validation; audit enqueue/dequeue events.

Monitoring & Logging (Datadog/CloudWatch or SIEM)

Security Requirements:

Secure ingestion endpoints, role-based access to dashboards, and encrypted storage for logs.
Integration must not leak PII to public dashboards.

Risk Assessment: Medium — logs contain sensitive info; exposure could expose PII or secrets.

Recommended Controls:

Redact or mask PII in logs prior to ingestion; use separate role-based dashboards for sensitive telemetry.
Protect alerting channels with MFA and integrate monitoring alerts into incident response workflows.

HR/External Identity or Directory Sync (if integrated later)

Security Requirements:

Use SCIM or secure API with OAuth2; consent and least-privilege provisioning.
Implement reconciliation and mutual authentication.

Risk Assessment: High — provisioning errors can result in privilege escalation or orphaned accounts.

Recommended Controls:

Keep provisioning scope minimal, audit provisioning events, and provide manual approval steps for sensitive role assignments.

Overall Integration and Orchestration Notes

All integrations must be captured in a supplier security profile (SLA, incident response expectations, audit rights).
Use encryption-in-flight and at-rest consistently; prefer private network connectivity (VPC, PrivateLink) where supported.
Log correlation IDs end-to-end for tracing solver jobs from submission through solution commit or rejection.
Implement automated smoke tests and contract tests for integrations; include negative tests (malformed payloads, replayed responses).
Maintain a supplier risk register and conduct periodic security reviews and penetration tests involving third-parties.

Appendix — Operational and Governance Recommendations (concise)

CI/CD: Sign build artifacts, enforce SCA and dependency scanning, require PR code reviews, and gate deployments with security checks.
Secrets Management: Centralize secrets in KMS/secret manager with automated rotation and narrow IAM roles.
Incident Response: Playbooks for compromised solver responses, mass export detection, or data exfiltration; tabletop exercises twice yearly.
Privacy & Compliance: Conduct PIAs for preference and leave modules; document legal basis for data processing and support DSAR/erasure workflows.
Testing: Include fuzzing for solver parser, localization-based XSS test cases, RBAC pentesting, and multi-tenant isolation testing.
Personnel: Least-privilege admin accounts, break glass procedures with audit and short TTL, enforce MFA, and periodic access reviews.
Operational Monitoring: SIEM rules for unusual export volumes, mass changes in shifts, repeated failed auth attempts, and anomalous solver acceptances.

This document, when applied across engineering, platform, and security ops, provides a coherent, defense-in-depth architecture that enables secure handling of sensitive employee scheduling data, trustworthy integration with external solvers, and auditable operations suitable for a multi-tenant cloud-hosted Shift Management System.

10. Implementation Roadmap

This section provides a prioritized, phased approach for implementing the security controls identified throughout this analysis. The roadmap organizes security measures into logical phases based on risk, dependencies, and resource availability, ensuring critical security gaps are addressed first while building a foundation for comprehensive security coverage.

10.1. Prioritization Framework

Prioritization of security controls is crucial to effectively mitigate risks while aligning with compliance requirements and resource constraints. This approach ensures that the most critical vulnerabilities and compliance obligations are addressed promptly, enabling a structured path toward holistic security maturity. Each criterion was carefully considered to ensure a comprehensive and efficient implementation plan.

Prioritization Criteria:

Risk Level: Controls addressing critical and high-risk threats (identified through threat modeling) are prioritized first
Compliance Deadlines: Regulatory requirements and compliance deadlines influence immediate priority
Technical Complexity: Controls requiring foundational infrastructure are implemented early to enable subsequent controls
Dependencies: Controls that other security measures depend upon are prioritized accordingly
Resource Availability: Implementation considers the availability of skilled personnel, tools, and budget
Business Impact: Controls protecting business-critical functions and data receive higher priority

These criteria work together to create a logical implementation sequence that balances security needs with practical constraints, ensuring that each phase builds on the previous one, addressing the most pressing risks while setting the stage for long-term security improvements.

10.2. Phased Implementation Plan

Phase: IMMEDIATE

Timeline: 0-1 months

Rationale: This phase focuses on addressing critical vulnerabilities and compliance blockers to protect the most sensitive data and essential functions immediately.

Controls to Implement:

Fix XSS vulnerabilities to prevent session token theft
Implement strong RBAC and tenant isolation to prevent cross-tenant data exposure
Enforce basic encryption for sensitive data in transit and at rest
Address critical compliance blockers, such as GDPR and CCPA consent mechanisms

Dependencies:

Completion of initial threat assessments
Availability of skilled security engineers

Phase: SHORT-TERM

Timeline: 1-3 months

Rationale: These controls build upon immediate security measures, focusing on improving access control adjustments and ensuring that logging and API security mitigate identified threats effectively.

Controls to Implement:

Enhance user authentication through comprehensive multi-factor authentication
Deploy role-based access controls across the admin dashboard
Implement comprehensive logging and monitoring for all administrative actions
Strengthen API security with input validation and HTTPS protocols
Begin encryption for all sensitive data at rest

Dependencies:

Completion of TLS Implementation
Completion of multi-factor authentication

Phase: MEDIUM-TERM

Timeline: 3-6 months

Rationale: This phase addresses advanced threat detection and security automation to enhance the overall security posture and prepare for third-party audits.

Controls to Implement:

Deploy advanced threat detection and response systems
Automate security testing processes, including SAST and DAST
Conduct third-party security audits to assess and improve defenses
Enhance data protection measures for sensitive export and backup files

Dependencies:

Completion of comprehensive logging and monitoring
Availability of third-party auditors

Phase: LONG-TERM

Timeline: 6-12 months

Rationale: Strategic initiatives to enhance security maturity and prepare the organization for future challenges through continuous improvement and education.

Controls to Implement:

Implement security maturity enhancements and continuous improvement processes
Deploy advanced AI/ML-based security controls for anomaly detection
Conduct comprehensive penetration testing for all critical systems
Introduce security awareness programs for all personnel

Dependencies:

Established baseline security posture from earlier phases
Availability of budget for advanced technologies

Phase: ONGOING

Timeline: Continuous

Rationale: Ensure continuous security monitoring, compliance audits, and incident response readiness to maintain a robust security posture.

Controls to Implement:

Maintain continuous security monitoring and patch management
Conduct regular compliance audits and risk assessments
Ensure incident response readiness and conduct regular drills

Dependencies:

Established incident response team and procedures

10.3. Resource Requirements

Skills: Security engineers, Security architects, Web developers, Compliance specialists;
Recommended tools: SIEM solutions for logging and monitoring, Vulnerability scanners for testing, Encryption libraries for data protection, API management tools for secure interfaces;
Estimated time effort: Approximately 3-6 months for initial phases, with ongoing efforts extending resources as per system complexity and requirements.

11. Verification and Testing Strategy

11.1. Testing Approach

Integrate security testing throughout the software development lifecycle (SDLC) with an emphasis on continuous security practices. Balance automated scanning with manual evaluations to prioritize high-risk areas based on business impact, adhering to shift-left security principles by incorporating security testing earlier and continuously. This approach ensures that vulnerabilities are identified and addressed promptly, aligning with both compliance requirements and overall risk management strategies.

11.2. Testing Methods

Method	Frequency	Tools
STATIC APPLICATION SECURITY TESTING (SAST)	Every commit/build	SonarQube, Semgrep, Checkmarx
DYNAMIC APPLICATION SECURITY TESTING (DAST)	Nightly/weekly	OWASP ZAP, Burp Suite, Acunetix
DEPENDENCY SCANNING	Every build	Snyk, Dependabot, OWASP Dependency-Check
SECRETS SCANNING	Every commit	TruffleHog, GitLeaks, GitHub Secret Scanning
CONTAINER/INFRASTRUCTURE SCANNING	Every deployment	Trivy, Clair, Prowler, ScoutSuite
PENETRATION TESTING	Quarterly or before major releases	Custom scripts, Metasploit, Burp Suite Pro
SECURITY CODE REVIEW	For critical features	GitHub/GitLab code review, Security checklists
COMPLIANCE SCANNING	Continuous	AWS Config, Azure Policy, Cloud Custodian

11.3. Compliance Verification

Multi-standard compliance (OWASP ASVS, NIST SP 800-53, ISO 27001) will be verified through automated tools and manual checks against regulatory requirements such as GDPR, CCPA, and PCI-DSS. Audit preparation will involve ensuring documentation and evidence collection for external audits, particularly focusing on the handling of sensitive data. This will include maintaining logs for consent events and data access, as well as implementing policies for the retention and secure deletion of personal data. Recommendations will include engaging third-party auditors for comprehensive evaluations to ensure compliance with all applicable regulations.

11.4. Continuous Monitoring

Implement Security Information and Event Management (SIEM) for real-time monitoring, supported by Intrusion Detection/Prevention Systems (IDS/IPS) to identify and mitigate threats. All logs will be aggregated and analyzed for anomalies, incorporating behavioral analytics to identify patterns indicative of potential security incidents. This integration into incident response processes will ensure prompt action against security events, allowing for a proactive approach to security management.

11.5. Key Performance Indicators (KPIs)

Mean time to detect (MTTD) security issues
Mean time to remediate (MTTR) vulnerabilities
Percentage of critical vulnerabilities patched within SLA
Security test coverage percentage
False positive rate in automated scanning
Compliance audit pass rate

11.6. Mapping Testing Methods to Security Controls

SAST: Verifies controls related to input validation, injection flaws, and hardcoded secrets (OWASP ASVS V2.1, NIST AC-2, ISO 27001 A.9.2.1).
DAST: Assesses authentication, authorization, XSS, CSRF, and SQL injection vulnerabilities (OWASP ASVS V2.2, NIST IA-2, ISO 27001 A.9.4.2).
Dependency Scanning: Addresses vulnerabilities in third-party libraries and supply chain security (OWASP ASVS V3.9).
Secrets Scanning: Detects exposed credentials and API keys (OWASP ASVS V6.1).
Container/Infrastructure Scanning: Ensures compliance with configuration management controls (NIST SC-7, ISO 27001 A.14.2.5).
Penetration Testing: Validates all high-risk controls (OWASP ASVS V4.1, NIST AC-3).
Security Code Review: Focuses on critical code related to authentication, authorization, and cryptographic implementations (OWASP ASVS V2.3, NIST IA-5).
Compliance Scanning: Automates checks against applicable compliance standards (GDPR, HIPAA, PCI-DSS).

12. Validation Report

This section presents a comprehensive validation of the security requirements generated throughout this analysis. The validation evaluates the requirements against five key dimensions: completeness, consistency, correctness, implementability, and alignment with business objectives. This assessment ensures that the security requirements are comprehensive, technically sound, and actionable for implementation teams.

12.1. Overall Assessment

The overall validation score reflects the quality and completeness of the security requirements across five critical dimensions. Each dimension is scored from 0.0 to 1.0, with 1.0 representing excellent coverage and 0.0 indicating significant gaps.

Overall Score: 0.81/1.0

Validation Status: ✅ PASSED

The security requirements have met the quality threshold (≥0.8) and are ready for implementation. The requirements demonstrate comprehensive coverage, technical accuracy, and alignment with business objectives.

The validation assesses:

Completeness: Are all identified security concerns adequately addressed?
Consistency: Do requirements align with each other without contradictions?
Correctness: Are controls appropriate for the identified risks and correctly applied?
Implementability: Are requirements specific, actionable, and feasible to implement?
Alignment: Do security requirements align with business requirements and objectives?

12.2. Dimension Scores

Dimension	Score	Status
Completeness	0.72	⚠️
Consistency	0.88	✅
Correctness	0.84	✅
Implementability	0.76	⚠️
Alignment	0.86	✅

Score Interpretation: - ✅ 0.8-1.0: Excellent - ⚠️ 0.7-0.79: Acceptable (minor improvements needed) - ❌ <0.7: Needs significant improvement

12.3. Detailed Feedback

Summary of assessment: Strengths: The security mapping is broad and maps most high-level functional requirements to appropriate OWASP/NIST/ISO controls. Multi-tenant isolation, API security for the external solver, encryption, logging/audit, privacy, and AI/ML-specific considerations are all present. The cross-functional controls give a good foundational set (encryption, logging, input validation, access control, privacy). Key gaps and prioritized actionable recommendations (specific and implementable): 1) Strong authentication & account protection (High priority) - Add explicit Multi-Factor Authentication (MFA) requirement for ADMIN and MANAGER roles and optional for EMPLOYEE. Specify supported methods (TOTP, WebAuthn, SMS discouraged) and fallback/legacy flows. Add account lockout and adaptive rate-limiting/brute-force protections with thresholds and lockout durations. - Specify password policy details (min length, complexity, reuse prevention, rotation policy if used) and server-side checks. 2) Session and cookie security (High priority) - Require secure, HttpOnly, SameSite cookies for session tokens where applicable; define session idle and absolute timeouts and administrative forced logout/invalidation (token revocation) for role/status changes. 3) Secrets, keys, and certificate management (High priority) - Add explicit KMS usage, secret rotation frequency, storage rules (no secrets in repo), and CI/CD secrets handling. Define TLS certificate lifecycle and mutual TLS for solver integration if used. 4) Tenant isolation and authorization specifics (High priority) - Strengthen multi-tenant requirement with concrete implementation expectations: include tenant_id in every API call authenticated principal, enforce DB-level isolation (row-level security or separate schemas), and require automated tests that attempt cross-tenant access. Define manager scoping: managers can only CRUD within their company and cannot escalate privileges across tenants — add test cases. 5) Data lifecycle, GDPR/CCPA operations and deletion (High priority) - Add implementable privacy controls: retention schedules, deletion workflows (soft-delete vs hard-delete), data export redaction rules per role, and detailed end-to-end deletion verification for Right-to-Erasure. Capture legal basis and consent metadata schema for each processing purpose. 6) Export and DLP controls (High priority) - Specify per-export templates and fields, role-based export approvals, automatic redaction rules for sensitive fields (health reasons, personal identifiers), and logging/alerting for mass exports. Consider rate limits and approval workflow for large exports. 7) Incident response, monitoring, and alerting (Medium-High priority) - Define alerting criteria for suspicious activity (mass failed logins, unusual export volume, solver anomalies), mean time to detect/respond SLAs, and include playbooks for solver compromise/data leakage and data breach notifications requirements for regulatory compliance. 8) AI/ML and solver-specific hardening (Medium priority) - Replace generic “prompt injection” language with structured payload hardening: define solver input schema, strict schema validation, payload size limits, payload signing (HMAC) and response signature verification or integrity checks, sandboxing of parsing code, and anomaly detection for unexpected solver outputs. Record solver-run provenance and keep solver inputs/outputs in the audit trail but redact PII where unnecessary. - Add a supplier security requirement for the external solver (attestation, SOC2/ISO evidence) and contractual SLA for incident handling. 9) Logging, retention, and tamper-evidence (Medium priority) - Specify retention durations per log type, access controls for logs, WORM or signed-log strategy for consent and audit-critical logs, and procedures for secure log archiving and destruction. 10) Secure development & supply chain (Medium priority) - Add requirements for dependency scanning, SCA, code signing, CI/CD pipeline hardening, and vulnerability management (CVE triage timeline and patching SLAs). 11) Operational and implementability details (Medium priority) - Convert high-level controls into explicit, testable acceptance criteria: e.g., token expiry (access token 15m, refresh 7d), password policy rules, MFA enforcement rules, RBAC matrix mapping roles to API endpoints, RLS policy examples, export redaction rules, logging fields schema (actor, ip, timestamp, resource, before/after), solver payload schema, and job queue encryption/ACLs. 12) Testing and verification (Medium priority) - Add concrete test cases: RBAC tests per endpoint, cross-tenant access attempts, fuzzing/Unicode tests for i18n, XSS tests across calendar/tables, CSRF tests for state-changing actions, solver-mock negative tests (malformed responses), and data-deletion verification for GDPR. Miscellaneous improvements: - Clarify applicability of some regulations (e.g., COPPA only if under-13 users are expected) to avoid unnecessary controls. - Provide concrete retention durations, log retention and deletion policies, and evidence requirements for audits. - Add marketplace/operational controls for admin console access (IP allowlisting, privilege escalation approval workflows). If you want, I can produce a prioritized implementation backlog mapping each recommended addition to acceptance tests, API-level requirements, and sample policy text for contracts/PIA templates.

Appendix A: Original Requirements Document

Shift Management System Requirements

We need to build a web application for managing employee shifts, assignments, and scheduling with automated optimization capabilities.

Key Features:

1. User Management
  - User registration with email verification
  - Authentication (credentials and Google OAuth)
  - Password reset
  - Role-based access control (ADMIN, MANAGER, EMPLOYEE)
  - User status management (ACTIVE, INACTIVE, UNVERIFIED)
  - User profile management
  - Admin/Manager user CRUD (a manager can CRUD only his company’s employees)
  - Company assignment for users
2. Company Management
  - Company CRUD (Admin only)
  - Multi-tenant support (users, shift types, skills scoped to companies)
  - Company assignment for managers and employees
3. Shift Types
  - Create, read, update, delete shift types
  - Define start and end times
  - Associate required skills with shift types
  - Company-scoped shift types
4. Shift Assignment
  - Manual shift assignment (create, update, delete)
  - Shift status tracking (SCHEDULED, CONFIRMED, COMPLETED, CANCELLED, NO_SHOW)
  - Calendar view for shifts
  - Shift filtering and search (by user, shift type, status, date)
  - Pagination and sorting
  - Shift preview on a calendar view
5. Auto-Assignment (Optimization)
  - Automated shift assignment via external solver API
  - Date range selection for auto-assignment
  - Real-time solution polling and status updates
  - Solution scoring (hard/soft constraints)
  - Constraint violation analysis and reporting
  - Preview of generated assignments before acceptance
  - Accept/reject generated assignments
  - Validation to prevent duplicate shifts in date ranges
6. Shift Preferences
  - Date-specific preferences (DESIRED/UNDESIRED)
  - Employee preference management
  - Preference tracking for optimization
7. Unavailable Dates
  - Leave management (SICK_LEAVE, VACATION, PERSONAL_LEAVE, UNPAID_LEAVE, OTHER)
  - Date range unavailability
  - Reason tracking
  - Employee and manager access
8. Skills Management
  - Skill CRUD
  - Associate skills with users
  - Associate required skills with shift types
  - Skill-based matching for shift assignments
  - Company-scoped skills
9. Data Export
  - Export shifts, users, companies, skills, shift types, preferences, and unavailable dates
  - Export formats: CSV and XLSX
10.  External API Integration
  - Integration with external optimization solver (Timefold backend)
  - Asynchronous job processing with polling
  - Solution status tracking
  - Constraint analysis via external API
  - Payload generation for solver
  - Solution parsing and validation
11. Internationalization
   - Multi-language support
   - Translated UI elements
   - Localized date/time formatting

12. User Interface
   - Responsive sidebar navigation
   - Pagination for data tables
   - Sorting and filtering
   - Search functionality
   - Calendar views
   - Alert/notification system
   - Breadcrumb navigation
   - Legal documents (Privacy Policy, Terms of Service)

The application will store user data, company information, shift assignments, preferences, and integration data. It will integrate with external optimization services and support multi-tenant company workspaces.

Appendix B: Glossary

Term	Definition
ASVS	Application Security Verification Standard (OWASP)
STRIDE	Spoofing, Tampering, Repudiation, Information Disclosure, Denial of Service, Elevation of Privilege
SAST	Static Application Security Testing
DAST	Dynamic Application Security Testing
MFA	Multi-Factor Authentication
RBAC	Role-Based Access Control
PII	Personally Identifiable Information
PHI	Protected Health Information
GDPR	General Data Protection Regulation
HIPAA	Health Insurance Portability and Accountability Act
PCI-DSS	Payment Card Industry Data Security Standard

Appendix C: Complete Threat List

This appendix contains the complete list of all identified threats with full descriptions and mitigation strategies. Threats are organized by risk level for easy reference.

Critical Risk Threats

THR-001 - Frontend Layer (SPA) - Calendar & Tables

Category: Information Disclosure / Spoofing
Likelihood: High | Impact: High
Risk Level: Critical
Description: Reflected or stored XSS in UI (calendar, shift preview, user profile) allows an attacker to run JS in another user’s session, exfiltrate session tokens, hijack accounts, or perform actions on behalf of the user.
Mitigation Strategy: Enforce output encoding/escaping on all user-supplied content; use a strict Content Security Policy (CSP) with nonces; sanitize inputs server-side and client-side, avoid innerHTML; use frameworks’ safe templating; review third-party libs; run regular automated and manual XSS testing (DAST/SAST).

THR-008 - Application Services - Authentication

Category: Spoofing
Likelihood: High | Impact: High
Risk Level: Critical
Description: Credential stuffing, weak passwords, or lack of MFA leads to account takeover of ADMIN/MANAGER accounts allowing large-scale damage.
Mitigation Strategy: Enforce strong password policies, rate-limit authentication attempts, use account lockouts or adaptive throttling, require MFA for privileged roles, integrate breached-password checks and anomaly detection, encourage SSO (Google) with secure config.

High Risk Threats

THR-003 - Frontend Layer (Token Handling)

Category: Spoofing / Information Disclosure
Likelihood: Medium | Impact: High
Risk Level: High
Description: Session tokens or OAuth tokens stored insecurely in localStorage or accessible JS can be stolen via XSS or malicious extensions, enabling account takeover.
Mitigation Strategy: Use secure, httpOnly cookies with SameSite attributes for session tokens; minimize token lifetime; use token rotation and refresh tokens stored securely; implement strong CSP and XSS mitigations; detect anomalous sessions and revoke tokens.

THR-004 - Frontend Layer / External Services (Google OAuth)

Category: Spoofing
Likelihood: Medium | Impact: High
Risk Level: High
Description: Open redirect or incorrect OAuth redirect URI validation allows attackers to capture authorization codes or tokens via a malicious callback, leading to account takeover.
Mitigation Strategy: Strictly validate redirect_uris against allowlist; use PKCE for OAuth flows; verify state parameter and nonce; enforce HTTPS on callback URIs; monitor for abnormal OAuth grant patterns.

THR-005 - Edge Layer (CDN/WAF/TLS)

Category: Information Disclosure / Tampering
Likelihood: Medium | Impact: High
Risk Level: High
Description: TLS termination or CDN misconfiguration (weak ciphers, expired certs, missing HSTS) could allow MitM, protocol downgrade, or data interception between clients and edge.
Mitigation Strategy: Enforce strong TLS configuration (TLS1.2+ recommended, prefer 1.3), HSTS, secure certificate lifecycle management, automate renewals, monitor TLS telemetry, enable HTTP Strict Transport Security, and perform periodic TLS scans.

THR-006 - Edge Layer (WAF & API Gateway)

Category: Tampering / Information Disclosure
Likelihood: Medium | Impact: High
Risk Level: High
Description: WAF rule bypass or insufficient WAF rules allow injection payloads (SQLi, XSS) to reach backend; misconfigured gateway could leak internal details via verbose errors.
Mitigation Strategy: Implement layered WAF rules including OWASP top 10 protections; use positive allowlists for APIs; sanitize error messages; enable anomaly detection and tuning; use gateway-level request validation and schema checks.

THR-009 - Application Services - Password Reset

Category: Spoofing / Repudiation
Likelihood: Medium | Impact: High
Risk Level: High
Description: Weak or predictable password reset tokens, or emails sent with insufficient verification, allow attackers to reset passwords and take over accounts.
Mitigation Strategy: Use long, cryptographically secure, single-use tokens with short TTL; bind token to user agent/IP metadata; log and notify users of resets; rate limit reset requests; verify identity for high-privilege resets; avoid leaking account existence info.

THR-010 - Application Services - OAuth Integration

Category: Spoofing
Likelihood: Medium | Impact: High
Risk Level: High
Description: Compromised or replayed OAuth tokens from Google OAuth could be used to impersonate users if token validation is insufficient.
Mitigation Strategy: Validate ID token signatures and claims server-side; check token expiry and audience; implement token revocation and rotation; use PKCE and state parameters; map OAuth identities carefully to internal accounts with additional checks for privileged ops.

THR-011 - Application Services - RBAC / Multi-tenant Checks

Category: Elevation of Privilege
Likelihood: Medium | Impact: High
Risk Level: High
Description: Broken access control or insufficient tenant scoping may allow a manager/admin/employee to view or modify data for other companies or elevate privileges.
Mitigation Strategy: Implement centralized, fine-grained RBAC and tenant authorization checks on the server side (deny-by-default); perform authorization at every entry point; use automated tests for tenant isolation; include ABAC claims (tenant_id, role) in tokens and validate them server-side.

THR-012 - Application Services - Multi-Tenancy

Category: Information Disclosure / Tampering
Likelihood: Medium | Impact: High
Risk Level: High
Description: Data leakage across tenants due to incorrect SQL queries, shared caches, or improper tenant-scoped identifiers could expose PII and shift data of other companies.
Mitigation Strategy: Use strict tenant_id scoping in queries, prepared statements, row-level security or separate schemas per tenant if appropriate; segregate caches (prefix keys by tenant_id), encrypt data at rest, review multi-tenant design in threat model.

THR-013 - Application Services - Shift APIs / DB Layer

Category: Tampering (Injection)
Likelihood: Medium | Impact: High
Risk Level: High
Description: SQL injection, NoSQL injection or command injection via poorly validated parameters (search, filtering, sorting) could lead to data theft or corruption.
Mitigation Strategy: Use parameterized queries/ORMs, input validation and canonicalization, allowlist sorting/filtering fields, use least privilege DB accounts, run SAST and SQLi testing, employ web application firewall rules tailored to injections.

THR-014 - Auto-Assignment (Optimizer Orchestration)

Category: Tampering / Integrity
Likelihood: Medium | Impact: High
Risk Level: High
Description: An attacker could manipulate optimization payloads, acceptance flow, or solver responses (malformed or malicious solution) to force incorrect assignments (e.g., assign unauthorized employees to shifts) or bypass constraints.
Mitigation Strategy: Sign and validate payloads and responses; use mutual TLS or API keys with IP allowlisting for Timefold; validate solver results against business rules server-side; sandbox and review solutions; require manager approval for critical changes; maintain an immutable audit trail.

THR-016 - Application Services - Audit & Logging

Category: Repudiation
Likelihood: Medium | Impact: High
Risk Level: High
Description: Insufficient or tamperable audit logs allow malicious actors to erase traces of actions (shift changes, acceptance) or administrators to repudiate actions.
Mitigation Strategy: Append-only audit logs, write to immutable storage or WORM-enabled object storage, centralize logs to a managed SIEM, sign or hash log entries, restrict log access, and monitor for log deletion events.

THR-017 - Data Layer - Object Storage (Exports/Artifacts)

Category: Information Disclosure
Likelihood: Medium | Impact: High
Risk Level: High
Description: Misconfigured S3-like buckets or signed URLs with overly long TTLs could leak CSV/XLSX exports or optimizer artifacts publicly, exposing PII and shift data.
Mitigation Strategy: Enforce bucket policies denying public access, use short-lived signed URLs, server-side access control by tenant, encrypt objects at rest, log and monitor object access, and scan object buckets for public exposure.

THR-018 - Data Layer - Managed RDBMS

Category: Information Disclosure
Likelihood: Medium | Impact: High
Risk Level: High
Description: Database credentials stored insecurely (in code, misconfigured secrets management) or overly-permissive DB accounts allow attackers or insiders to dump tenant data.
Mitigation Strategy: Use managed secrets (KMS/Secret Manager), rotate credentials regularly, enforce least privilege DB roles, network isolate DB (VPC), enable encryption at rest, enable DB auditing, and use IAM-based auth where available.

THR-020 - Data Layer - Cache/Session Store (Redis)

Category: Spoofing / Information Disclosure
Likelihood: Medium | Impact: High
Risk Level: High
Description: Compromise of cache/session store could allow theft of session tokens or tenant-scoped cached data, enabling session hijacking or data leakage.
Mitigation Strategy: Network-restrict access to cache (VPC security groups), enable AUTH and TLS on Redis, do not store long-lived secrets in cache, rotate session tokens and invalidate sessions on suspicious activity, isolate keys per tenant, and monitor access.

THR-021 - External Services - Timefold Solver Integration

Category: Information Disclosure / Tampering
Likelihood: Medium | Impact: High
Risk Level: High
Description: Sensitive optimization payloads (employee availability, leave, skills) transmitted to or stored by the external solver may be exposed if the external service is compromised or communication is intercepted.
Mitigation Strategy: Minimize sensitive data sent to external solver; use strong transport security (mTLS), enable payload encryption where possible, contractually require security controls from provider, implement data minimization and anonymization, and maintain an audit of payloads sent.

THR-022 - External Services - Timefold Solver / Solver Responses

Category: Tampering / Elevation of Privilege
Likelihood: Medium | Impact: High
Risk Level: High
Description: Malicious or malformed solver responses could instruct the application to create invalid/privileged assignments or bypass constraints if insufficiently validated.
Mitigation Strategy: Validate solver outputs against server-side business rules and constraints before applying; require manager acceptance for significant changes; verify score integrity; sandbox parsing logic and implement strict schema validation for responses.

THR-023 - External Services - Email Delivery Provider

Category: Information Disclosure / Repudiation
Likelihood: Medium | Impact: High
Risk Level: High
Description: Compromised email provider or mis-sent transactional emails (password resets, verification) can be used for phishing or account takeover or accidental leakage of PII.
Mitigation Strategy: Use a reputable provider with security SLAs; sign emails (DKIM/SPF/DMARC), limit PII in emails, use templated safe content, rate-limit mass emails, monitor bounce/reputation, and provide out-of-band verification for critical operations.

THR-024 - External Services - Google OAuth Provider

Category: Spoofing
Likelihood: Medium | Impact: High
Risk Level: High
Description: Compromise of Google OAuth accounts or misconfiguration (improperly mapped accounts) allowing attackers to authenticate as other users or link accounts incorrectly.
Mitigation Strategy: Implement verification steps when linking OAuth accounts; check verified email claims; require additional verification for privileged role assignment; detect and alert on suspicious OAuth logins (new IP/geo), and support account unlinking and emergency access removal.

THR-030 - User Interface (Cookies / Session)

Category: Elevation of Privilege
Likelihood: Medium | Impact: High
Risk Level: High
Description: XSS or insecure cookie settings allow session cookie theft leading to privilege escalation (e.g., attacker operates as manager/admin).
Mitigation Strategy: Use httpOnly and Secure cookies with SameSite attributes, rotate sessions on privilege changes, provide session management UI for users, invalidate sessions on suspicious activity, and enforce MFA for privileged actions.

Medium Risk Threats

THR-002 - Frontend Layer & Application Services (Forms & Actions)

Category: Tampering (CSRF)
Likelihood: Medium | Impact: Medium
Risk Level: Medium
Description: Cross-Site Request Forgery: authenticated users could be induced to submit state-changing requests (assignments, accept generated shifts) from another origin.
Mitigation Strategy: Implement anti-CSRF tokens on state-changing endpoints or use SameSite=strict/strictish cookies for session tokens; require explicit user confirmation for risky ops (e.g., commit auto-assignment); validate Origin/Referer headers; use CORS allowlist.

THR-007 - Edge Layer (Rate Limiting)

Category: Denial of Service
Likelihood: Medium | Impact: Medium
Risk Level: Medium
Description: Absence or weak rate limiting allows brute-force, enumeration, or abusive polling (e.g., optimizer polling) causing backend overload or service degradation.
Mitigation Strategy: Apply per-IP, per-user, and per-endpoint rate limits; exponential backoff; CAPTCHAs for suspicious flows (login); token bucket throttling; protect long-polling endpoints with quotas; monitor metrics and alert on spikes.

THR-015 - Application Services - Background Jobs / Queue

Category: Denial of Service / Tampering
Likelihood: Medium | Impact: Medium
Risk Level: Medium
Description: Queue or job system abuse (poisoned jobs, replayed jobs, or malformed payloads) can cause failures in optimizer orchestration, duplicate processing, or resource exhaustion.
Mitigation Strategy: Validate and sanitize queued payloads, enforce max job size and rate limits, implement dead-letter queues and idempotency tokens, use job signing or auth, monitor queue depth and job error rates, and use per-tenant job quotas.

THR-019 - Data Layer - Backups & Export Files

Category: Information Disclosure
Likelihood: Medium | Impact: Medium
Risk Level: Medium
Description: Backups, exported CSV/XLSX, or optimizer artifacts containing PII may be retained insecurely or sent to external systems without encryption, leading to data leakage.
Mitigation Strategy: Encrypt backups and exports at rest and in transit, restrict access to backups, apply retention and deletion policies, sanitize exports (redact sensitive fields when possible), and log export/download events per tenant.

THR-025 - External Services - Monitoring & Logging

Category: Information Disclosure
Likelihood: Medium | Impact: Medium
Risk Level: Medium
Description: Sensitive data (PII, tokens) in logs or monitoring metrics sent to third-party services may leak across organizations or be accessible to unauthorized parties.
Mitigation Strategy: Redact or mask PII/tokens before sending to logs; use sampling and data minimization; restrict access to monitoring dashboards; apply retention policies; use encryption for logs in transit and at rest.

THR-026 - Data Export Feature (CSV/XLSX)

Category: Tampering / Information Disclosure
Likelihood: Medium | Impact: Medium
Risk Level: Medium
Description: Exported spreadsheets containing user-entered fields could include CSV injection (formula injection) or contain sensitive PII unexpectedly; exported files may be downloaded using unsecured links.
Mitigation Strategy: Sanitize cell content (prefix ’ or use safe formatting to avoid formula execution), require authentication to download, use short-lived signed URLs, perform pre-export redaction options, and log export events per user and tenant.

THR-027 - Auto-Assignment (Concurrency)

Category: Tampering / Denial of Service
Likelihood: Medium | Impact: Medium
Risk Level: Medium
Description: Race conditions between auto-assignment job acceptance and manual edits can create duplicate shifts, gaps, or inconsistent state across tenants.
Mitigation Strategy: Use transactional operations, optimistic concurrency control (versioning), idempotency tokens for operations, and perform final validation before commit; provide conflict resolution UI and alerting.

THR-028 - API Gateway / Frontend Polling (Optimizer Polling)

Category: Denial of Service
Likelihood: Medium | Impact: Medium
Risk Level: Medium
Description: Abuse of real-time polling endpoints (frequent polling for optimization status) can overwhelm backend services, increasing costs and causing outages.
Mitigation Strategy: Implement backoff, push mechanisms (WebSockets/Server-Sent Events) with authenticated subscribe, enforce polling rate limits, introduce caching for status, and apply quotas per tenant.

THR-029 - Internationalization / Date-Time Handling

Category: Tampering / Information Disclosure
Likelihood: Medium | Impact: Medium
Risk Level: Medium
Description: Locale and timezone misparsing or injection of malformed locale strings could cause incorrect shift calculations, exposing different tenants’ data or mis-scheduling employees.
Mitigation Strategy: Normalize and validate all locale/timezone inputs against known allowlists, store all times in UTC and render locale-aware only in UI, add unit and integration tests for date conversions, and log unexpected locale values.

Total Threats: 30

Appendix D: Complete Requirements Traceability Matrix

This appendix provides complete end-to-end traceability from requirements through threats to controls and verification.

Full Traceability Table

Req ID	Requirement	Category	Sensitivity	Threat IDs	Security Controls	Priority	Verification	Status
REQ-001	User registration with email verification and acco…	Authentication / Identity Management	High	THR-001, THR-002, THR-003 +7	[OWASP] V2.1, [NIST] AC-2, [ISO27001] A.9.2.1 +1	Critical	Review implementation of email verification flow, inspect token properties (single-use, expiry), and test account behavior before and after verification., Audit account management procedures, review logs of account create/disable/delete events, and verify policy enforcement through test cases.	Pending
REQ-002	Authentication supporting credentials-based login …	Authentication / Integration	High	THR-003, THR-004, THR-008 +2	[OWASP] V2.2, [NIST] IA-2, [ISO27001] A.9.4.2 +1	Critical	Examine policies for federated identity, test SSO flows for proper authentication, and verify credential handling meets organizational standards., Inspect token storage methods, test revocation and refresh flows, and review scope requests during OAuth handshake.	Pending
REQ-003	Password reset and account recovery flows with sec…	Authentication / Account Recovery	High	THR-001, THR-003, THR-004 +7	[OWASP] V2.3, [NIST] IA-5 (5), [OWASP] V5.1 +1	Critical	Review recovery policies, validate multi-step verification for sensitive accounts, and inspect logs of recovery events., Test reset flows for token reuse, expiry, and ensure resets require verified contact; perform abuse-case testing.	Pending
REQ-004	Role-based access control (ADMIN, MANAGER, EMPLOYE…	Authorization / Multi-tenancy	High	THR-001, THR-002, THR-003 +7	[OWASP] V4.1, [NIST] AC-3, [ISO27001] A.9.1.2 +1	Critical	Audit automation integrations, simulate HR-driven status changes, and verify system enforces new statuses immediately., Review access control policy documentation and interview personnel to confirm implementation.	Pending
REQ-005	User profile management, including personal detail…	Data Management / User Management	Medium	THR-001, THR-002, THR-008 +5	[OWASP] V4.6, [NIST] AC-6, [ISO27001] A.9.2.2 +1	High	Review code paths for profile update endpoints, perform unauthorized modification tests, and inspect audit logs., Check privilege assignments for profile-management components and test unauthorized assignment attempts.	Pending
REQ-006	Admin-only company CRUD and multi-tenant data isol…	Multi-tenant Administration	High	THR-001, THR-002, THR-005 +7	[OWASP] V14.1, [NIST] SC-7, [ISO27001] A.13.2.1 +1	Critical	Review data access code, run multi-tenant isolation tests (attempt cross-tenant reads/writes), and inspect database policies., Review policy documents and sample transfer approvals; test that transfers are blocked or logged when not permitted.	Pending
REQ-007	Create, read, update, delete shift types with star…	Scheduling / Configuration	Medium	THR-001, THR-002, THR-012 +7	None	Medium	Manual Review	Pending
REQ-008	Manual shift assignment: create, update, delete sh…	Scheduling / Operations	High	THR-001, THR-002, THR-004 +7	[OWASP] V4.4, [NIST] AU-2, [ISO27001] A.12.4.1 +1	Critical	Inspect logs for the required events, retention configuration, and access controls around logs., Review permission mappings and test that lower-privileged roles cannot modify shifts.	Pending
REQ-009	Shift status lifecycle and tracking (SCHEDULED, CO…	Scheduling / Audit & Reporting	Medium	THR-001, THR-002, THR-012 +7	[NIST] AU-6, [OWASP] V10.1, [ISO27001] A.12.4.3 +1	High	Check logs for operator entries and review processes for manual status changes., Review change records for status transition rule updates and verify approvals were enforced.	Pending
REQ-010	Calendar view with shift preview, search, filterin…	User Interface / Scheduling	Low	THR-001, THR-002, THR-011 +7	None	Medium	Manual Review	Pending
REQ-011	Automated shift assignment via external solver API…	Optimization / Integration	High	THR-001, THR-002, THR-004 +7	[OWASP] V13.1, [NIST] SA-9, [ISO27001] A.15.1.1 +1	Critical	Inspect TLS configuration, perform MITM tests, and verify payload signatures if implemented., Review supplier contracts, interface security documentation, and test compliance with the defined integration policy.	Pending
REQ-012	Asynchronous job processing for optimization reque…	Integration / System Operations	Medium	THR-014, THR-015, THR-021 +1	[NIST] SC-13, [OWASP] V14.3, [ISO27001] A.12.1.1 +1	Critical	Inspect integrity verification code paths and attempt to submit tampered payloads to confirm detection., Inspect queue ACLs, test unauthorized enqueue/dequeue attempts, and validate payload schema checks.	Pending
REQ-013	Solution scoring (hard/soft constraint metrics), c…	Optimization / Reporting	Medium	THR-014, THR-021, THR-022	[OWASP] V11.2, [NIST] PM-22, [ISO27001] A.18.1.4 +1	High	Inspect audit logs for scoring events and test correlation between algorithm runs and generated logs., Review privacy assessments and validate that logs/reporting exclude unnecessary personal data or are appropriately protected.	Pending
REQ-014	Validation to prevent duplicate shifts across the …	Scheduling / Data Integrity	High	THR-002, THR-004, THR-010 +7	None	Medium	Manual Review	Pending
REQ-015	Employee shift preferences management with date-sp…	Scheduling / Preferences	Medium	THR-001, THR-002, THR-007 +7	[ISO27001] A.18.1.4, [NIST] PL-4, [OWASP] V1.5 +1	High	Review privacy documentation and confirm preference handling is aligned with policy and retention rules., Test access to preference records from different roles and verify unauthorized reads are blocked.	Pending
REQ-016	Unavailable dates and leave management (SICK_LEAVE…	Scheduling / HR Data	High	THR-003, THR-013, THR-014 +5	[ISO27001] A.18.1.4, [NIST] PL-4, [NIST] MP-6 +1	Critical	Review data classification, access controls, and privacy handling for leave data., Provide PIA output and evidence of mitigations (pseudonymization, restricted access).	Pending
REQ-017	Skill management: CRUD for skills, skills associat…	Scheduling / Workforce Management	Low	THR-001, THR-002, THR-010 +7	[NIST] AC-3 (5), [OWASP] V4.2, [ISO27001] A.9.2.2 +1	High	Review provisioning logs and sample attribute provenance to ensure correct assignment., Attempt to alter skill attributes via API/UI and confirm authorization prevents incorrect matching.	Pending
REQ-018	Data export in CSV and XLSX for entities: shifts, …	Data Management / Reporting	High	THR-001, THR-002, THR-005 +7	[ISO27001] A.18.1.4, [NIST] PL-4, [NIST] MP-6 +1	Critical	Review data classification, access controls, and privacy handling for leave data., Provide PIA output and evidence of mitigations (pseudonymization, restricted access).	Pending
REQ-019	External API integration with Timefold solver: sec…	Integration / Security	High	THR-003, THR-004, THR-006 +7	[OWASP] V11.2, [NIST] PM-22, [ISO27001] A.18.1.4 +1	High	Inspect audit logs for scoring events and test correlation between algorithm runs and generated logs., Review privacy assessments and validate that logs/reporting exclude unnecessary personal data or are appropriately protected.	Pending
REQ-020	Internationalization: multi-language support for U…	User Experience / Localization	Low	THR-001, THR-002, THR-010 +7	[OWASP] V9.7, [NIST] SC-17, [ISO27001] A.14.2.5 +1	High	Run locale-specific input validation tests and check canonicalization outputs., Test inputs with various Unicode characters and locale-specific formats to detect XSS or parsing issues.	Pending
REQ-021	User interface capabilities: responsive sidebar na…	User Interface / Usability	Low	THR-001, THR-002, THR-010 +7	[OWASP] V9.2, [NIST] SI-10, [ISO27001] A.12.2.1 +1	Critical	Review server-side validation for UI query parameters and inspect error messages for sensitive info., Check secure development artifacts, dependency scans, and UI security test results.	Pending
REQ-022	Audit logging and notifications: record critical o…	Security / Compliance	High	THR-001, THR-002, THR-010 +7	None	Medium	Manual Review	Pending
REQ-023	Legal and privacy: present Privacy Policy, Terms o…	Compliance / Legal	High	THR-002, THR-004, THR-005 +7	[NIST] AU-2, [ISO27001] A.18.1.4, [OWASP] V10.3 +1	Critical	Review consent logs, verify they contain required fields, and test retrieval for audit scenarios., Verify retention of document versions and sample consent records match user acknowledgments.	Pending
REQ-024	Operational controls: per-tenant configuration, ra…	Operations / Reliability	Medium	THR-004, THR-015, THR-019 +5	None	Medium	Manual Review	Pending
REQ-025	Data protection controls: encryption at rest and i…	Security / Data Protection	High	THR-005, THR-011, THR-012 +7	None	Medium	Manual Review	Pending

Total Requirements Tracked: 25

Detailed Requirement Mappings

The following section provides detailed traceability for each requirement:

REQ-001: User registration with email verification and account lifecycle (UNVERIFIED -> ACTIVE/INACTIVE)

Related Threats:

THR-001: Reflected or stored XSS in UI (calendar, shift preview, user profile) allows an …
THR-002: Cross-Site Request Forgery: authenticated users could be induced to submit state…
THR-003: Session tokens or OAuth tokens stored insecurely in localStorage or accessible J…
THR-004: Open redirect or incorrect OAuth redirect URI validation allows attackers to cap…
THR-008: Credential stuffing, weak passwords, or lack of MFA leads to account takeover of…
…and 5 more threats

Security Controls:

[OWASP] V2.1: [OWASP] Verify new user registrations via email or other out-of-band mechanisms to ensur…
[NIST] AC-2: [NIST] The organization manages information system accounts, including account creation…
[ISO27001] A.9.2.1: [ISO27001] A formal user registration and de-registration process shall be implemented to e…
[NIST] IA-5: [NIST] Manage, distribute, and revoke credentials and authenticators throughout the acc…

Verification: Review implementation of email verification flow, inspect token properties (single-use, expiry), and test account behavior before and after verification., Audit account management procedures, review logs of account create/disable/delete events, and verify policy enforcement through test cases., Review credential lifecycle processes, test revocation and re-issuance flows, and inspect logs for authenticator events., Inspect documented procedures and sample records for adherence; validate that de-registration revokes access promptly.

Priority: Critical | Status: Pending

REQ-002: Authentication supporting credentials-based login and Google OAuth (SSO)

Related Threats:

THR-003: Session tokens or OAuth tokens stored insecurely in localStorage or accessible J…
THR-004: Open redirect or incorrect OAuth redirect URI validation allows attackers to cap…
THR-008: Credential stuffing, weak passwords, or lack of MFA leads to account takeover of…
THR-010: Compromised or replayed OAuth tokens from Google OAuth could be used to imperson…
THR-024: Compromise of Google OAuth accounts or misconfiguration (improperly mapped accou…

Security Controls:

[OWASP] V2.2: [OWASP] Support secure authentication including credential-based and federated authentic…
[NIST] IA-2: [NIST] Identify and authenticate organizational users using authenticators and, where a…
[ISO27001] A.9.4.2: [ISO27001] Secure log-on procedures shall be implemented, where appropriate supporting sing…
[OWASP] V5.3: [OWASP] Ensure tokens are validated, scoped, stored securely, and revoked when necessary…

Verification: Examine policies for federated identity, test SSO flows for proper authentication, and verify credential handling meets organizational standards., Inspect token storage methods, test revocation and refresh flows, and review scope requests during OAuth handshake., Review OAuth/OIDC implementation, verify token validation, scope restrictions, and perform token replay/forgery tests., Validate the log-on workflow, verify session creation after SSO, and review session timeout and logout behavior.

Priority: Critical | Status: Pending

REQ-003: Password reset and account recovery flows with secure tokenized links and rate-limiting

Related Threats:

THR-001: Reflected or stored XSS in UI (calendar, shift preview, user profile) allows an …
THR-003: Session tokens or OAuth tokens stored insecurely in localStorage or accessible J…
THR-004: Open redirect or incorrect OAuth redirect URI validation allows attackers to cap…
THR-008: Credential stuffing, weak passwords, or lack of MFA leads to account takeover of…
THR-009: Weak or predictable password reset tokens, or emails sent with insufficient veri…
…and 5 more threats

Security Controls:

[OWASP] V2.3: [OWASP] Implement secure password reset flows using verified contact channels and protec…
[NIST] IA-5 (5): [NIST] Establish policies and mechanisms for managing password resets and recovery in a…
[OWASP] V5.1: [OWASP] Recovery tokens and one-time use links must be single-use, short-lived, and prot…
[ISO27001] A.9.2.3: [ISO27001] Ensure controlled management of authentication data and password resets, includi…

Verification: Review recovery policies, validate multi-step verification for sensitive accounts, and inspect logs of recovery events., Test reset flows for token reuse, expiry, and ensure resets require verified contact; perform abuse-case testing., Review privileged reset controls, sampling of privileged account reset logs, and policy documentation., Inspect token generation and storage, attempt token replay tests, and verify expiry enforcement.

Priority: Critical | Status: Pending

REQ-004: Role-based access control (ADMIN, MANAGER, EMPLOYEE) with per-company scoping and user status flags …

Related Threats:

THR-001: Reflected or stored XSS in UI (calendar, shift preview, user profile) allows an …
THR-002: Cross-Site Request Forgery: authenticated users could be induced to submit state…
THR-003: Session tokens or OAuth tokens stored insecurely in localStorage or accessible J…
THR-010: Compromised or replayed OAuth tokens from Google OAuth could be used to imperson…
THR-011: Broken access control or insufficient tenant scoping may allow a manager/admin/e…
…and 5 more threats

Security Controls:

[OWASP] V4.1: [OWASP] Enforce role-based access control with least privilege and separation of duties;…
[NIST] AC-3: [NIST] Enforce access restrictions and ensure users are granted access only to authoriz…
[ISO27001] A.9.1.2: [ISO27001] An access control policy based on business and security requirements shall be es…
[NIST] AC-2 (3): [NIST] Automate account status changes (enable/disable) and maintain authoritative acco…

Verification: Audit automation integrations, simulate HR-driven status changes, and verify system enforces new statuses immediately., Review access control policy documentation and interview personnel to confirm implementation., Inspect policy-to-implementation mapping, run access matrix tests, and verify that disabled users cannot access resources., Review role definitions, test access control enforcement across endpoints for each role, and perform privilege escalation attempts.

Priority: Critical | Status: Pending

REQ-005: User profile management, including personal details, company assignment, and manager associations

Related Threats:

THR-001: Reflected or stored XSS in UI (calendar, shift preview, user profile) allows an …
THR-002: Cross-Site Request Forgery: authenticated users could be induced to submit state…
THR-008: Credential stuffing, weak passwords, or lack of MFA leads to account takeover of…
THR-010: Compromised or replayed OAuth tokens from Google OAuth could be used to imperson…
THR-011: Broken access control or insufficient tenant scoping may allow a manager/admin/e…
…and 3 more threats

Security Controls:

[OWASP] V4.6: [OWASP] Verify that updates to user profiles and assignments (e.g., company membership) …
[NIST] AC-6: [NIST] Employ least privilege mechanisms for user profile updates and assignment of org…
[ISO27001] A.9.2.2: [ISO27001] A formal process for granting and revoking access rights and attributes should b…
[OWASP] V1.1: [OWASP] Design systems to maintain clear trust boundaries so profile attributes that det…

Verification: Review code paths for profile update endpoints, perform unauthorized modification tests, and inspect audit logs., Check privilege assignments for profile-management components and test unauthorized assignment attempts., Review provisioning records and test the end-to-end process for correctness and auditability., Inspect trust boundary design, review data flow diagrams, and test for attribute spoofing.

Priority: High | Status: Pending

REQ-006: Admin-only company CRUD and multi-tenant data isolation (users, shift types, skills scoped per compa…

Related Threats:

THR-001: Reflected or stored XSS in UI (calendar, shift preview, user profile) allows an …
THR-002: Cross-Site Request Forgery: authenticated users could be induced to submit state…
THR-005: TLS termination or CDN misconfiguration (weak ciphers, expired certs, missing HS…
THR-011: Broken access control or insufficient tenant scoping may allow a manager/admin/e…
THR-012: Data leakage across tenants due to incorrect SQL queries, shared caches, or impr…
…and 5 more threats

Security Controls:

[OWASP] V14.1: [OWASP] Ensure logical separation of tenant data and enforce access controls to prevent …
[NIST] SC-7: [NIST] Implement controls to separate and protect system components and data flows; app…
[ISO27001] A.13.2.1: [ISO27001] Information transfer and segregation mechanisms should be defined to protect the…
[NIST] AC-6 (10): [NIST] Apply tenant-specific access restrictions and scoping to limit access to tenant …

Verification: Review data access code, run multi-tenant isolation tests (attempt cross-tenant reads/writes), and inspect database policies., Review policy documents and sample transfer approvals; test that transfers are blocked or logged when not permitted., Verify per-tenant role mappings, test scoped permissions, and run negative tests attempting cross-tenant CRUD., Assess architecture diagrams, test separation of management interfaces, and review network segmentation controls.

Priority: Critical | Status: Pending

REQ-007: Create, read, update, delete shift types with start/end times and association to required skills, sc…

Related Threats:

THR-001: Reflected or stored XSS in UI (calendar, shift preview, user profile) allows an …
THR-002: Cross-Site Request Forgery: authenticated users could be induced to submit state…
THR-012: Data leakage across tenants due to incorrect SQL queries, shared caches, or impr…
THR-013: SQL injection, NoSQL injection or command injection via poorly validated paramet…
THR-014: An attacker could manipulate optimization payloads, acceptance flow, or solver r…
…and 5 more threats

Verification: Manual Review

Priority: Medium | Status: Pending

REQ-008: Manual shift assignment: create, update, delete shifts, with validation to prevent duplicate shifts …

Related Threats:

THR-001: Reflected or stored XSS in UI (calendar, shift preview, user profile) allows an …
THR-002: Cross-Site Request Forgery: authenticated users could be induced to submit state…
THR-004: Open redirect or incorrect OAuth redirect URI validation allows attackers to cap…
THR-010: Compromised or replayed OAuth tokens from Google OAuth could be used to imperson…
THR-012: Data leakage across tenants due to incorrect SQL queries, shared caches, or impr…
…and 5 more threats

Security Controls:

[OWASP] V4.4: [OWASP] Authorize all modification endpoints and verify checks server-side to prevent un…
[NIST] AU-2: [NIST] Determine and log auditable events including create, modify, delete operations.
[ISO27001] A.12.4.1: [ISO27001] Event logs recording user activities, exceptions, and security events shall be p…
[NIST] AC-6: [NIST] Restrict modify/delete/create operations to roles with explicit permissions.

Verification: Inspect logs for the required events, retention configuration, and access controls around logs., Review permission mappings and test that lower-privileged roles cannot modify shifts., Test role-based access to create/update/delete endpoints, and attempt unauthorized operations., Review audit logs for shift CRUD events and validate completeness and integrity.

Priority: Critical | Status: Pending

REQ-009: Shift status lifecycle and tracking (SCHEDULED, CONFIRMED, COMPLETED, CANCELLED, NO_SHOW) with audit…

Related Threats:

THR-001: Reflected or stored XSS in UI (calendar, shift preview, user profile) allows an …
THR-002: Cross-Site Request Forgery: authenticated users could be induced to submit state…
THR-012: Data leakage across tenants due to incorrect SQL queries, shared caches, or impr…
THR-013: SQL injection, NoSQL injection or command injection via poorly validated paramet…
THR-014: An attacker could manipulate optimization payloads, acceptance flow, or solver r…
…and 5 more threats

Security Controls:

[NIST] AU-6: [NIST] Regularly review and analyze audit records for indications of unauthorized activ…
[OWASP] V10.1: [OWASP] Ensure logs and status transitions are recorded in tamper-resistant logs and int…
[ISO27001] A.12.4.3: [ISO27001] Administrator and operator activities, including status changes, should be logge…
[NIST] CM-3: [NIST] Control and document changes to system configuration and state transitions.

Verification: Check logs for operator entries and review processes for manual status changes., Review change records for status transition rule updates and verify approvals were enforced., Review audit processes, sample status transition logs, and ensure alerts are configured for anomalies., Inspect log storage protections and attempt to modify logs; verify detection of tamper attempts.

Priority: High | Status: Pending

REQ-010: Calendar view with shift preview, search, filtering (by user, shift type, status, date), pagination …

Related Threats:

THR-001: Reflected or stored XSS in UI (calendar, shift preview, user profile) allows an …
THR-002: Cross-Site Request Forgery: authenticated users could be induced to submit state…
THR-011: Broken access control or insufficient tenant scoping may allow a manager/admin/e…
THR-012: Data leakage across tenants due to incorrect SQL queries, shared caches, or impr…
THR-013: SQL injection, NoSQL injection or command injection via poorly validated paramet…
…and 5 more threats

Verification: Manual Review

Priority: Medium | Status: Pending

REQ-011: Automated shift assignment via external solver API with date range selection, preview of generated a…

Related Threats:

THR-001: Reflected or stored XSS in UI (calendar, shift preview, user profile) allows an …
THR-002: Cross-Site Request Forgery: authenticated users could be induced to submit state…
THR-004: Open redirect or incorrect OAuth redirect URI validation allows attackers to cap…
THR-012: Data leakage across tenants due to incorrect SQL queries, shared caches, or impr…
THR-013: SQL injection, NoSQL injection or command injection via poorly validated paramet…
…and 5 more threats

Security Controls:

[OWASP] V13.1: [OWASP] Securely integrate with third-party APIs using mutual authentication, input/outp…
[NIST] SA-9: [NIST] Ensure that external interfaces are secured and that integration with external s…
[ISO27001] A.15.1.1: [ISO27001] Establish controls for supplier relationships including security requirements fo…
[NIST] SC-8: [NIST] Protect the confidentiality and integrity of information during transmission to …

Verification: Inspect TLS configuration, perform MITM tests, and verify payload signatures if implemented., Review supplier contracts, interface security documentation, and test compliance with the defined integration policy., Review API authentication configuration, test injection or malformed response handling, and verify server validates solver outputs., Inspect supplier agreements and evidence of supplier security practices and audits.

Priority: Critical | Status: Pending

REQ-012: Asynchronous job processing for optimization requests, with real-time polling, solution status updat…

Related Threats:

THR-014: An attacker could manipulate optimization payloads, acceptance flow, or solver r…
THR-015: Queue or job system abuse (poisoned jobs, replayed jobs, or malformed payloads) …
THR-021: Sensitive optimization payloads (employee availability, leave, skills) transmitt…
THR-028: Abuse of real-time polling endpoints (frequent polling for optimization status) …

Security Controls:

[NIST] SC-13: [NIST] Use cryptography to protect data in transit and at rest in asynchronous messagin…
[OWASP] V14.3: [OWASP] Ensure job queues and background processing components enforce authentication, a…
[ISO27001] A.12.1.1: [ISO27001] Operational procedures should define and control background processing and messa…
[NIST] SI-7: [NIST] Implement integrity checks for data processed asynchronously to detect tampering…

Verification: Inspect integrity verification code paths and attempt to submit tampered payloads to confirm detection., Inspect queue ACLs, test unauthorized enqueue/dequeue attempts, and validate payload schema checks., Review encryption configurations for queues and endpoints, and test interception attempts., Review operational procedures and perform runbook drills to validate behavior.

Priority: Critical | Status: Pending

REQ-013: Solution scoring (hard/soft constraint metrics), constraint violation analysis, and reporting of sol…

Related Threats:

THR-014: An attacker could manipulate optimization payloads, acceptance flow, or solver r…
THR-021: Sensitive optimization payloads (employee availability, leave, skills) transmitt…
THR-022: Malicious or malformed solver responses could instruct the application to create…

Security Controls:

[OWASP] V11.2: [OWASP] Log inputs, configuration, and outputs of automated decision algorithms to suppo…
[NIST] PM-22: [NIST] Document and analyze how automated solutions are validated, scored, and how viol…
[ISO27001] A.18.1.4: [ISO27001] Ensure compliance with regulatory requirements for automated processing and prov…
[NIST] AU-12: [NIST] Generate audit records for security-relevant events including algorithm outputs …

Verification: Inspect audit logs for scoring events and test correlation between algorithm runs and generated logs., Review privacy assessments and validate that logs/reporting exclude unnecessary personal data or are appropriately protected., Review documentation and validation artifacts and confirm reporting pipelines produce expected outputs., Check that algorithmic inputs/outputs are logged and can be correlated to user-visible reports.

Priority: High | Status: Pending

REQ-014: Validation to prevent duplicate shifts across the date range both for manual and auto-assignment wor…

Related Threats:

THR-002: Cross-Site Request Forgery: authenticated users could be induced to submit state…
THR-004: Open redirect or incorrect OAuth redirect URI validation allows attackers to cap…
THR-010: Compromised or replayed OAuth tokens from Google OAuth could be used to imperson…
THR-012: Data leakage across tenants due to incorrect SQL queries, shared caches, or impr…
THR-013: SQL injection, NoSQL injection or command injection via poorly validated paramet…
…and 5 more threats

Verification: Manual Review

Priority: Medium | Status: Pending

REQ-015: Employee shift preferences management with date-specific preference types (DESIRED/UNDESIRED) persis…

Related Threats:

THR-001: Reflected or stored XSS in UI (calendar, shift preview, user profile) allows an …
THR-002: Cross-Site Request Forgery: authenticated users could be induced to submit state…
THR-007: Absence or weak rate limiting allows brute-force, enumeration, or abusive pollin…
THR-010: Compromised or replayed OAuth tokens from Google OAuth could be used to imperson…
THR-011: Broken access control or insufficient tenant scoping may allow a manager/admin/e…
…and 5 more threats

Security Controls:

[ISO27001] A.18.1.4: [ISO27001] Ensure compliance with regulatory requirements for automated processing and prov…
[NIST] PL-4: [NIST] Conduct privacy impact assessments for systems processing personal preferences.
[OWASP] V1.5: [OWASP] Design systems to minimize collection of personal data and protect user preferen…
[NIST] AC-19: [NIST] Protect user attribute data including preferences with appropriate access contro…

Verification: Review privacy documentation and confirm preference handling is aligned with policy and retention rules., Test access to preference records from different roles and verify unauthorized reads are blocked., Inspect data schemas and UI controls for preference management and test deletion/exports to ensure removal., Provide PIA documentation and evidence of mitigations implemented based on findings.

Priority: High | Status: Pending

REQ-016: Unavailable dates and leave management (SICK_LEAVE, VACATION, PERSONAL_LEAVE, UNPAID_LEAVE, OTHER) w…

Related Threats:

THR-003: Session tokens or OAuth tokens stored insecurely in localStorage or accessible J…
THR-013: SQL injection, NoSQL injection or command injection via poorly validated paramet…
THR-014: An attacker could manipulate optimization payloads, acceptance flow, or solver r…
THR-018: Database credentials stored insecurely (in code, misconfigured secrets managemen…
THR-021: Sensitive optimization payloads (employee availability, leave, skills) transmitt…
…and 3 more threats

Security Controls:

[ISO27001] A.18.1.4: [ISO27001] Ensure compliance with regulatory requirements for automated processing and prov…
[NIST] PL-4: [NIST] Conduct privacy impact assessments when processing sensitive personal data such …
[NIST] MP-6: [NIST] Protect sensitive personal data at rest and in transit, and sanitize when export…
[OWASP] V1.5: [OWASP] Implement privacy-by-design for sensitive employee data, minimizing collection a…

Verification: Review data classification, access controls, and privacy handling for leave data., Provide PIA output and evidence of mitigations (pseudonymization, restricted access)., Inspect encryption at rest, review export sanitization routines, and test role-based export restrictions., Review UI/data collection forms and retention policies; verify secure storage controls in place.

Priority: Critical | Status: Pending

REQ-017: Skill management: CRUD for skills, skills associated with users and shift types, and skill-based mat…

Related Threats:

THR-001: Reflected or stored XSS in UI (calendar, shift preview, user profile) allows an …
THR-002: Cross-Site Request Forgery: authenticated users could be induced to submit state…
THR-010: Compromised or replayed OAuth tokens from Google OAuth could be used to imperson…
THR-012: Data leakage across tenants due to incorrect SQL queries, shared caches, or impr…
THR-013: SQL injection, NoSQL injection or command injection via poorly validated paramet…
…and 5 more threats

Security Controls:

[NIST] AC-3 (5): [NIST] Support attribute-based access control when access decisions depend on attribute…
[OWASP] V4.2: [OWASP] Implement and verify attribute-based authorization where access and matching log…
[ISO27001] A.9.2.2: [ISO27001] Provision access and attributes carefully to ensure accurate assignment of skill…
[NIST] PM-11: [NIST] Ensure data used for decision making (e.g., skills) is accurate and maintained.

Verification: Review provisioning logs and sample attribute provenance to ensure correct assignment., Attempt to alter skill attributes via API/UI and confirm authorization prevents incorrect matching., Review ABAC policies and test that assignments respect skill attribute constraints., Check data quality reports and validation procedures for skill records.

Priority: High | Status: Pending

REQ-018: Data export in CSV and XLSX for entities: shifts, users, companies, skills, shift types, preferences…

Related Threats:

THR-001: Reflected or stored XSS in UI (calendar, shift preview, user profile) allows an …
THR-002: Cross-Site Request Forgery: authenticated users could be induced to submit state…
THR-005: TLS termination or CDN misconfiguration (weak ciphers, expired certs, missing HS…
THR-011: Broken access control or insufficient tenant scoping may allow a manager/admin/e…
THR-012: Data leakage across tenants due to incorrect SQL queries, shared caches, or impr…
…and 5 more threats

Security Controls:

[ISO27001] A.18.1.4: [ISO27001] Ensure compliance with regulatory requirements for automated processing and prov…
[NIST] PL-4: [NIST] Conduct privacy impact assessments when processing sensitive personal data such …
[NIST] MP-6: [NIST] Protect sensitive personal data at rest and in transit, and sanitize when export…
[OWASP] V1.5: [OWASP] Implement privacy-by-design for sensitive employee data, minimizing collection a…

Priority: Critical | Status: Pending

REQ-019: External API integration with Timefold solver: secure payload generation, transport (TLS+auth), solu…

Related Threats:

THR-003: Session tokens or OAuth tokens stored insecurely in localStorage or accessible J…
THR-004: Open redirect or incorrect OAuth redirect URI validation allows attackers to cap…
THR-006: WAF rule bypass or insufficient WAF rules allow injection payloads (SQLi, XSS) t…
THR-010: Compromised or replayed OAuth tokens from Google OAuth could be used to imperson…
THR-014: An attacker could manipulate optimization payloads, acceptance flow, or solver r…
…and 5 more threats

Security Controls:

[OWASP] V11.2: [OWASP] Log inputs, configuration, and outputs of automated decision algorithms to suppo…
[NIST] PM-22: [NIST] Document and analyze how automated solutions are validated, scored, and how viol…
[ISO27001] A.18.1.4: [ISO27001] Ensure compliance with regulatory requirements for automated processing and prov…
[NIST] AU-12: [NIST] Generate audit records for security-relevant events including algorithm outputs …

Priority: High | Status: Pending

REQ-020: Internationalization: multi-language support for UI elements and localized date/time formatting per …

Related Threats:

THR-001: Reflected or stored XSS in UI (calendar, shift preview, user profile) allows an …
THR-002: Cross-Site Request Forgery: authenticated users could be induced to submit state…
THR-010: Compromised or replayed OAuth tokens from Google OAuth could be used to imperson…
THR-011: Broken access control or insufficient tenant scoping may allow a manager/admin/e…
THR-012: Data leakage across tenants due to incorrect SQL queries, shared caches, or impr…
…and 5 more threats

Security Controls:

[OWASP] V9.7: [OWASP] Properly handle Unicode, normalization, and encoding to prevent injection and XS…
[NIST] SC-17: [NIST] Ensure localized data formats and time/date handling do not weaken security mech…
[ISO27001] A.14.2.5: [ISO27001] Include security requirements for localized applications and data handling in de…
[OWASP] V9.1: [OWASP] Validate and canonicalize input considering locale-specific encodings and format…

Verification: Run locale-specific input validation tests and check canonicalization outputs., Test inputs with various Unicode characters and locale-specific formats to detect XSS or parsing issues., Inspect development checklists and localized test cases for security considerations., Review date/time handling code and test across locales for consistent behavior of security-sensitive features.

Priority: High | Status: Pending

Showing detailed mappings for 20 of 25 requirements.

Appendix E: References

End of Report - Generated by Security Requirements Analysis System v2.0 Generated: 2025-11-19 19:29:59

--- title: "Security Requirements Analysis Report" subtitle: "Comprehensive Security Analysis with Interactive Dashboard" author: "Security Requirements System v2.0" date: "2025-11-19 19:29:59" format: html: page-layout: full toc: true toc-depth: 3 toc-location: left embed-resources: true code-fold: true code-tools: true fig-width: 8 fig-height: 5 fig-dpi: 300 number-sections: false smooth-scroll: true mermaid-format: svg execute: echo: false warning: false message: false freeze: auto jupyter: python3 --- *Generated: 2025-11-19 19:29:59* *Report Version: 2.0 - Comprehensive Security Analysis* --- ## 1. Executive Summary This section provides a high-level overview of the security requirements analysis, presenting key findings, validation results, and an interactive dashboard for stakeholders and decision-makers. The executive summary enables rapid comprehension of the security posture, critical risks, control coverage, and compliance status without requiring detailed technical knowledge. ### 1.1. Purpose and Scope **Purpose** This document presents a comprehensive security requirements analysis for the proposed application, systematically mapping high-level business requirements to specific, actionable security controls aligned with multiple industry standards: OWASP Application Security Verification Standard (ASVS), NIST SP 800-53 Rev 5, and ISO 27001:2022. The analysis provides a complete security requirements specification that guides secure system design, implementation, and verification. **Scope** This analysis encompasses all functional requirements provided, delivering comprehensive coverage across multiple security domains: - **Requirements Analysis**: Systematic decomposition and security-relevant extraction from business requirements - **Stakeholder Analysis**: Identification of stakeholders, trust boundaries, and security responsibilities - **Threat Modeling**: Systematic identification and assessment of security threats using STRIDE methodology - **Security Control Mapping**: Mapping requirements to multi-standard security controls (OWASP ASVS, NIST SP 800-53, ISO 27001) with detailed implementation guidance - **Compliance Requirements**: Identification of regulatory and legal compliance obligations - **Architectural Security**: Security architecture recommendations and design patterns - **Implementation Planning**: Prioritized, phased implementation roadmap - **Verification Strategies**: Testing and validation approaches for security controls The analysis provides both strategic guidance for security planning and tactical details for implementation teams. ### 1.2. Key Findings This section summarizes the most critical results from the security requirements analysis, providing executives and stakeholders with immediate insight into the security posture and validation status. **Analysis Metrics** - **Validation Score**: 0.81/1.0 - **Validation Status**: ✅ Passed - **Analysis Iterations**: 1 - **Requirements Analyzed**: 20 **Application Summary** A multi-tenant web application to manage employee shift types, scheduling, assignments, preferences, and leave, with role-based access for Admins, Managers, and Employees and an automated optimization workflow that integrates with an external solver (Timefold) to generate, preview, score, and accept/reject optimized assignments while providing calendar views, export capabilities, and multilingual UI. The validation score reflects the quality and completeness of the security requirements across five dimensions: completeness, consistency, correctness, implementability, and alignment with business objectives. A score of 0.8 or higher indicates that the requirements are ready for implementation, while scores below this threshold may require refinement before proceeding. ### 1.3. Security Overview Dashboard This interactive dashboard provides executive-level visualization of key security metrics and trends, enabling rapid assessment of the security posture through intuitive charts and data visualizations. The dashboard presents critical information across multiple dimensions: risk distribution, security control coverage, compliance status, implementation progress, and data quality metrics. For optimal viewing experience, render this document with Quarto to enable interactive chart functionality, allowing stakeholders to explore data dynamically and drill down into specific areas of interest. ::: {.panel-tabset} #### Risk ```{python} #| label: load-metrics #| echo: false #| warning: false import json import pandas as pd from pathlib import Path # Load dashboard data artifacts artifacts_path = Path("artifacts_20251119_192959") threats = pd.read_json(artifacts_path / "threats.json") asvs = pd.read_json(artifacts_path / "asvs_mapping.json") priorities = pd.read_json(artifacts_path / "priorities.json") compliance = pd.read_json(artifacts_path / "compliance.json") delivery = pd.read_json(artifacts_path / "delivery.json") coverage = pd.read_json(artifacts_path / "coverage.json") validation = json.loads((artifacts_path / "validation.json").read_text()) ``` ```{python} #| label: fig-risk-heatmap #| fig-cap: "Risk heat map showing threat distribution by likelihood and impact (1-5 scale)." #| echo: false #| warning: false try: import plotly.express as px import plotly.graph_objects as go # Create risk heatmap heat = threats.groupby(["likelihood", "impact"]).size().reset_index(name="count") # Create a complete 5x5 grid import numpy as np l_range = range(1, 6) i_range = range(1, 6) grid_data = [] for l in l_range: for i in i_range: count = heat[(heat["likelihood"] == l) & (heat["impact"] == i)]["count"].sum() grid_data.append({"likelihood": l, "impact": i, "count": int(count)}) heat_df = pd.DataFrame(grid_data) pivot = heat_df.pivot(index="impact", columns="likelihood", values="count").fillna(0) fig_risk = go.Figure(data=go.Heatmap( z=pivot.values, x=[f"L{x}" for x in pivot.columns], y=[f"I{y}" for y in pivot.index], text=pivot.values, texttemplate="%{text:.0f}", textfont={"size": 12}, colorscale="YlOrRd", hoverongaps=False )) fig_risk.update_layout( title="Threat Risk Matrix (Likelihood × Impact)", xaxis_title="Likelihood →", yaxis_title="Impact →", height=400 ) fig_risk.show() except Exception as e: print(f"⚠️ Could not generate risk heatmap: {e}") print("\nRisk Distribution (Static):") print(threats.groupby("risk_level").size()) ``` **Top 5 Highest Risks:** ```{python} #| echo: false #| output: asis #| warning: false top_risks = threats.nlargest(5, ["likelihood", "impact"]) for idx, risk_row in top_risks.iterrows(): risk_id = risk_row['id'] risk_level = risk_row['risk_level'] component = risk_row.get('component', 'Unknown Component') category = risk_row.get('category', 'N/A') likelihood = risk_row.get('likelihood', 'N/A') impact = risk_row.get('impact', 'N/A') description = risk_row['description'] print(f"**{risk_id}** ({risk_level}) - {component}") print(f"- **Category:** {category}") print(f"- **Likelihood:** {likelihood} | **Impact:** {impact}") print(f"- **Description:** {description}") print("") ``` #### Controls ```{python} #| label: fig-standard-distribution #| fig-cap: "Security control distribution by standard (OWASP, NIST, ISO 27001)." #| echo: false #| warning: false try: import plotly.express as px # Group by standard if "standard" in asvs.columns: dist = asvs.groupby("standard").size().reset_index(name="controls") dist = dist.sort_values("controls", ascending=False) # Add percentage for better context total = dist["controls"].sum() dist["percentage"] = (dist["controls"] / total * 100).round(1) # Map standard codes to display names standard_names = { "OWASP": "OWASP ASVS", "NIST": "NIST SP 800-53", "ISO27001": "ISO 27001:2022" } dist["standard_name"] = dist["standard"].map(standard_names).fillna(dist["standard"]) fig_std = px.bar( dist, x="standard_name", y="controls", text=[f"{c}<br>({p}%)" for c, p in zip(dist["controls"], dist["percentage"])], title="Security Controls by Standard", labels={"standard_name": "Security Standard", "controls": "Control Count"}, color="controls", color_continuous_scale="Blues" ) fig_std.update_traces(textposition='outside') fig_std.update_layout(height=400, showlegend=False) fig_std.show() else: print("Standard distribution data not available.") except Exception as e: print(f"⚠️ Could not generate standard distribution chart: {e}") ``` ```{python} #| label: fig-asvs-distribution #| fig-cap: "OWASP ASVS control distribution by verification category (V1-V14)." #| echo: false #| warning: false try: import plotly.express as px # Filter to OWASP controls only asvs_owasp = asvs[asvs["standard"] == "OWASP"] if "standard" in asvs.columns else asvs # Group by ASVS category dist = asvs_owasp.groupby("v_category").size().reset_index(name="controls") dist = dist.sort_values("v_category") # Add percentage for better context total = dist["controls"].sum() dist["percentage"] = (dist["controls"] / total * 100).round(1) if total > 0 else 0 fig_asvs = px.bar( dist, x="v_category", y="controls", text=[f"{c}<br>({p}%)" for c, p in zip(dist["controls"], dist["percentage"])], title="OWASP ASVS Controls by Verification Category", labels={"v_category": "ASVS Category", "controls": "Control Count"}, color="controls", color_continuous_scale="Blues" ) fig_asvs.update_traces(textposition='outside') fig_asvs.update_layout(height=400, showlegend=False) fig_asvs.show() except Exception as e: print(f"⚠️ Could not generate ASVS chart: {e}") ``` ```{python} #| label: fig-priority-breakdown #| fig-cap: "Security control priority distribution (Critical/High/Medium/Low)." #| echo: false #| warning: false try: import plotly.express as px # Priority breakdown with color mapping color_map = { "Critical": "#c62828", "High": "#f57c00", "Medium": "#fbc02d", "Low": "#388e3c" } # Sort by priority level priority_order = ["Critical", "High", "Medium", "Low"] priorities_sorted = priorities.set_index("level").reindex(priority_order).reset_index() fig_prio = px.bar( priorities_sorted, x="level", y="count", text="count", title="Control Priority Breakdown", labels={"level": "Priority Level", "count": "Number of Controls"}, color="level", color_discrete_map=color_map ) fig_prio.update_traces(textposition='outside') fig_prio.update_layout(height=400, showlegend=False) fig_prio.show() except Exception as e: print(f"⚠️ Could not generate priority chart: {e}") ``` **Coverage Metrics:** ```{python} #| echo: false #| output: asis #| warning: false total_controls = len(asvs) total_reqs = len(coverage) req_coverage = (coverage["has_controls"].mean() * 100) if not coverage.empty else 0 verif_coverage = (coverage["tests"].gt(0).mean() * 100) if not coverage.empty else 0 # Calculate additional metrics avg_controls_per_req = (total_controls / total_reqs) if total_reqs > 0 else 0 critical_controls = len(asvs[asvs["priority"] == "Critical"]) if "priority" in asvs.columns else 0 # Calculate standard distribution if available if "standard" in asvs.columns: std_counts = asvs["standard"].value_counts() owasp_count = std_counts.get("OWASP", 0) nist_count = std_counts.get("NIST", 0) iso_count = std_counts.get("ISO27001", 0) print(f"- **Total Security Controls Mapped:** {total_controls}") print(f" - OWASP ASVS: {owasp_count} controls") print(f" - NIST SP 800-53: {nist_count} controls") print(f" - ISO 27001: {iso_count} controls") else: print(f"- **Total Security Controls Mapped:** {total_controls} (OWASP ASVS, NIST SP 800-53, ISO 27001)") print(f"- **Requirements with Security Control Mapping:** {req_coverage:.1f}% ({coverage['has_controls'].sum()}/{total_reqs})") print(f"- **Average Controls per Requirement:** {avg_controls_per_req:.1f}") print(f"- **Critical Controls:** {critical_controls} ({critical_controls/total_controls*100:.1f}% of total)" if total_controls > 0 else "- **Critical Controls:** {critical_controls}") print(f"- **Requirements with Verification:** {verif_coverage:.1f}% ({coverage['tests'].gt(0).sum()}/{total_reqs})") print(f"- **Recommended ASVS Level:** L2 (Standard)") ``` #### Compliance ```{python} #| label: fig-compliance-rag #| fig-cap: "Compliance status across all applicable frameworks (Red-Amber-Green rating). Shows regulatory compliance (GDPR, HIPAA, PCI-DSS, etc.) and security standards (OWASP ASVS, NIST SP 800-53, ISO 27001)." #| echo: false #| warning: false try: import plotly.express as px # Show all compliance frameworks (regulatory and security standards) comp_filtered = compliance # Compliance RAG status status_map = { "Compliant": "#2e7d32", "In Progress": "#f9a825", "Gap": "#c62828" } # Sort frameworks alphabetically comp_sorted = comp_filtered.sort_values("framework") fig_comp = px.bar( comp_sorted, x="framework", y=[1] * len(comp_sorted), # Equal height bars color="status", color_discrete_map=status_map, title="Compliance Status Across All Frameworks", labels={"framework": "Framework", "y": ""}, text="status", height=400 ) fig_comp.update_layout(showlegend=True, yaxis_visible=False, yaxis_showticklabels=False) fig_comp.update_traces(textposition='inside') fig_comp.show() except Exception as e: print(f"⚠️ Could not generate compliance chart: {e}") print("\nCompliance Status (Static):") for _, row in compliance.iterrows(): print(f"- **{row['framework']}**: {row['status']}") ``` **Compliance Summary:** ```{python} #| echo: false #| output: asis #| warning: false for _, row in compliance.iterrows(): status_icon = "✅" if row["status"] == "Compliant" else "⚠️" if row["status"] == "In Progress" else "❌" print(f"- {status_icon} **{row['framework']}**: {row['status']} (Next Audit: {row['next_audit']})") ``` #### Delivery ```{python} #| label: fig-delivery-burndown #| fig-cap: "Projected implementation timeline by phase and week (based on priority-based planning)." #| echo: false #| warning: false try: import plotly.express as px import plotly.graph_objects as go # Create burndown chart with planned vs projected completion fig_burn = go.Figure() for phase in delivery["phase"].unique(): phase_data = delivery[delivery["phase"] == phase] # Planned line fig_burn.add_trace(go.Scatter( x=phase_data["week"], y=phase_data["planned"], mode='lines', name=f"{phase} (Planned)", line=dict(dash='dash', color='gray'), showlegend=True )) # Projected completion line fig_burn.add_trace(go.Scatter( x=phase_data["week"], y=phase_data["completed"], mode='lines+markers', name=f"{phase} (Projected)", showlegend=True )) fig_burn.update_layout( title="Security Controls Implementation Timeline (Projected)", xaxis_title="Week", yaxis_title="Number of Controls", height=400, hovermode='x unified' ) fig_burn.show() except Exception as e: print(f"⚠️ Could not generate delivery chart: {e}") ``` **Implementation Timeline (Projected):** ```{python} #| echo: false #| output: asis #| warning: false phase1 = delivery[delivery["phase"].str.contains("Phase 1")] phase2 = delivery[delivery["phase"].str.contains("Phase 2")] if not phase1.empty: p1_progress = (phase1["completed"].iloc[-1] / phase1["planned"].iloc[-1] * 100) if phase1["planned"].iloc[-1] > 0 else 0 print(f"- **Phase 1 (Critical/High):** {p1_progress:.0f}% projected completion (Weeks 1-8)") if not phase2.empty: p2_progress = (phase2["completed"].iloc[-1] / phase2["planned"].iloc[-1] * 100) if phase2["planned"].iloc[-1] > 0 else 0 print(f"- **Phase 2 (Medium):** {p2_progress:.0f}% projected completion (Weeks 9-16)") print(f"- **Phase 3 (Low/Ongoing):** Continuous improvement and monitoring") print(f"") print(f"*Note: Timeline is based on priority-based planning and assumes steady implementation progress.*") ``` #### Data Quality **Validation Metrics:** ```{python} #| echo: false #| output: asis #| warning: false val_score = validation.get("score", 0) val_passed = validation.get("passed", False) dims = validation.get("dims", {}) status_icon = "✅" if val_passed else "⚠️" if val_score >= 0.7 else "❌" print(f"") print(f"**Overall Validation Score:** {status_icon} {val_score:.2f}/1.0") print(f"") if dims: print("**Dimension Scores:**") print(f"") for dim, score in dims.items(): dim_icon = "✅" if score >= 0.8 else "⚠️" if score >= 0.7 else "❌" print(f"- {dim_icon} **{dim.capitalize()}:** {score:.2f}") else: print("*Dimension scores not available.*") ``` ```{python} #| label: fig-data-quality #| fig-cap: "Data quality and coverage metrics." #| echo: false #| warning: false try: import plotly.graph_objects as go # Calculate quality metrics threats_linked_pct = (coverage["has_threat"].mean() * 100) if not coverage.empty else 0 # Calculate average controls per requirement avg_controls_per_req = (total_controls / total_reqs) if total_reqs > 0 else 0 # For the chart, we'll show percentage-based metrics and handle avg controls separately metrics = { "Requirements Mapped": req_coverage, "Threats Linked": threats_linked_pct, "Verification Coverage": verif_coverage, "Avg Controls/Req": avg_controls_per_req * 20, # Scale for visual comparison (multiply by 20 to fit chart scale) "Validation Score": val_score * 100 } # Create custom text labels (show actual values for avg controls, percentages for others) text_labels = [] for key, val in metrics.items(): if key == "Avg Controls/Req": text_labels.append(f"{avg_controls_per_req:.1f}") else: text_labels.append(f"{val:.1f}%") fig_quality = go.Figure(go.Bar( x=list(metrics.values()), y=list(metrics.keys()), orientation='h', text=text_labels, textposition='outside', marker=dict( color=list(metrics.values()), colorscale='RdYlGn', cmin=0, cmax=100 ) )) fig_quality.update_layout( title="Data Quality & Coverage Metrics", xaxis_title="Score / Percentage (%)", xaxis=dict(range=[0, 110]), height=400, showlegend=False ) fig_quality.show() except Exception as e: print(f"⚠️ Could not generate quality chart: {e}") ``` ```{python} #| echo: false #| output: asis #| warning: false # Parser and data quality stats total_entries = len(coverage) with_threats = coverage["has_threat"].sum() with_controls = coverage["has_controls"].sum() with_tests = coverage["tests"].gt(0).sum() print(f"") print(f"**Traceability Matrix:**") print(f"") print(f"- Total Requirements: {total_entries}") print(f"- Linked to Threats: {with_threats} ({with_threats/max(total_entries,1)*100:.1f}%)") print(f"- Mapped to Security Controls: {with_controls} ({with_controls/max(total_entries,1)*100:.1f}%)") print(f"- With Verification: {with_tests} ({with_tests/max(total_entries,1)*100:.1f}%)") print(f"") print(f"**Data Quality:** {"✅ Excellent" if val_score >= 0.8 else "⚠️ Good" if val_score >= 0.7 else "❌ Needs Improvement"}") ``` ::: --- ## 2. Requirements Understanding This section presents a comprehensive analysis of the functional requirements, extracting security-relevant information and establishing the foundation for the security requirements specification. Understanding the functional requirements is essential for identifying security implications, data sensitivity, trust boundaries, and security-critical components. This analysis transforms business requirements into security-aware specifications that inform threat modeling, control selection, and compliance assessment. ### 2.1. High-Level Requirements Analysis The following high-level functional requirements have been identified and analyzed for security implications: 1. User registration with email verification and account lifecycle management 2. Authentication and single sign-on via credentials and Google OAuth 3. Password reset and account recovery 4. Role-based access control (ADMIN, MANAGER, EMPLOYEE) and user status management 5. User profile management and company assignment 6. Company CRUD and multi-tenant scoping of data 7. Shift type management with time ranges and required skills 8. Manual shift creation, update, deletion, and calendar presentation 9. Shift status tracking and filtering (SCHEDULED, CONFIRMED, COMPLETED, CANCELLED, NO_SHOW) 10. Automated shift assignment (auto-assignment) via external solver with preview and accept/reject 11. Real-time asynchronous job processing, polling, and solution status tracking 12. Solution scoring, constraint violation analysis, and reporting 13. Shift preferences management (date-specific desired/undesired) and preference tracking 14. Unavailable dates and leave management (multiple leave types, date ranges, reasons) 15. Skills management and skill-based matching for assignments 16. Export of data (shifts, users, companies, skills, shift types, preferences, unavailable dates) in CSV/XLSX 17. External API integration with Timefold solver including payload generation and solution parsing 18. Internationalization (multi-language UI and localized date/time formatting) 19. User interface features: responsive navigation, tables with pagination/sorting/filtering, calendar views, alerts/notifications, breadcrumbs 20. Audit logging, legal documents availability (Privacy Policy, Terms of Service), and consent tracking ### 2.2. Detailed Requirements Breakdown | Req ID | Requirement | Business Category | Security Sensitivity | Data Classification | |--------|-------------|-------------------|---------------------|---------------------| | REQ-001 | User registration with email verification and acco... | Authentication / Identity Management | High | Confidential | | REQ-002 | Authentication supporting credentials-based login ... | Authentication / Integration | High | Confidential | | REQ-003 | Password reset and account recovery flows with sec... | Authentication / Account Recovery | High | Confidential | | REQ-004 | Role-based access control (ADMIN, MANAGER, EMPLOYE... | Authorization / Multi-tenancy | High | Confidential | | REQ-005 | User profile management, including personal detail... | Data Management / User Management | Medium | Confidential | | REQ-006 | Admin-only company CRUD and multi-tenant data isol... | Multi-tenant Administration | High | Internal | | REQ-007 | Create, read, update, delete shift types with star... | Scheduling / Configuration | Medium | Internal | | REQ-008 | Manual shift assignment: create, update, delete sh... | Scheduling / Operations | High | Confidential | | REQ-009 | Shift status lifecycle and tracking (SCHEDULED, CO... | Scheduling / Audit & Reporting | Medium | Confidential | | REQ-010 | Calendar view with shift preview, search, filterin... | User Interface / Scheduling | Low | Internal | | REQ-011 | Automated shift assignment via external solver API... | Optimization / Integration | High | Confidential | | REQ-012 | Asynchronous job processing for optimization reque... | Integration / System Operations | Medium | Internal | | REQ-013 | Solution scoring (hard/soft constraint metrics), c... | Optimization / Reporting | Medium | Internal | | REQ-014 | Validation to prevent duplicate shifts across the ... | Scheduling / Data Integrity | High | Confidential | | REQ-015 | Employee shift preferences management with date-sp... | Scheduling / Preferences | Medium | Confidential | | REQ-016 | Unavailable dates and leave management (SICK_LEAVE... | Scheduling / HR Data | High | Restricted | | REQ-017 | Skill management: CRUD for skills, skills associat... | Scheduling / Workforce Management | Low | Internal | | REQ-018 | Data export in CSV and XLSX for entities: shifts, ... | Data Management / Reporting | High | Confidential | | REQ-019 | External API integration with Timefold solver: sec... | Integration / Security | High | Confidential | | REQ-020 | Internationalization: multi-language support for U... | User Experience / Localization | Low | Public | | REQ-021 | User interface capabilities: responsive sidebar na... | User Interface / Usability | Low | Public | | REQ-022 | Audit logging and notifications: record critical o... | Security / Compliance | High | Internal | | REQ-023 | Legal and privacy: present Privacy Policy, Terms o... | Compliance / Legal | High | Restricted | | REQ-024 | Operational controls: per-tenant configuration, ra... | Operations / Reliability | Medium | Internal | | REQ-025 | Data protection controls: encryption at rest and i... | Security / Data Protection | High | Restricted | ### 2.3. Security Context and Regulatory Obligations Applicable regulations and standards likely include GDPR (EU personal data processing, data subject rights, data transfers), CCPA/CPRA (California consumer privacy), regional data protection laws (vary by tenant), SOC 2/ISO 27001 for operational security and controls, and data minimization principles. OAuth best practices (RFCs), secure API communication (TLS), and proper handling of PII are required. If handling health-related leave data, consider additional jurisdictional protections for health data (e.g., extra safeguards though HIPAA applies only to covered entities). Accessibility (WCAG) and local labor laws for scheduling/worker rights may impose functional constraints. Logging and retention policies must meet legal and audit requirements. ### 2.4. Assumptions - System will be cloud-hosted (managed cloud provider) with support for multi-region deployment as needed for data residency requirements - Users have reliable internet access and modern browsers; mobile/responsive web is required - External solver (Timefold) provides authenticated HTTPS API endpoints and supports async job model and secure callbacks or polling - Email delivery service (transactional email) is available for verification and notifications - Each company tenant has at least one Admin account to manage tenant-level configuration - Tenants may have different locale/timezone requirements and will be configurable - Data export consumers are authorized by role-based permissions; exports are subject to auditing - No out-of-band HR/Payroll system integration is mandated in the initial scope (can be added later) - System will maintain audit logs for a configurable retention period - Encryption keys and secrets will be centrally managed (e.g., KMS/Secrets Manager) ### 2.5. Constraints - Must integrate with external Timefold solver API; optimization workflows constrained by solver API capabilities, rate limits, and availability - Asynchronous processing and polling required for long-running optimization tasks; UI must handle partial/ongoing states - Multi-tenant logical separation required; single code-base must enforce per-tenant scoping for data and operations - Support for CSV and XLSX export formats; exports may be large and must be streamed and rate-limited - Compliance constraints (GDPR/CCPA) may impose data residency, deletion, and consent functionality - Third-party auth (Google OAuth) requires configuration per tenant or global consent; fallback credential auth must exist - Performance: schedule optimization and large tenant datasets demand efficient pagination, indexing, and caching strategies - UI responsiveness and calendar rendering must scale to large numbers of shifts and users - Operational monitoring and alerting required for background jobs, external API failures, and integration errors - Retention and archival policies for audit logs, exports, and optimization artifacts must be defined to meet legal/audit needs --- ## 3. Stakeholder Analysis This section identifies and analyzes all stakeholders involved in or affected by the system, including users, administrators, external partners, and regulatory bodies. Stakeholder analysis establishes trust boundaries, defines security responsibilities, and identifies potential security concerns from different stakeholder perspectives. Understanding stakeholder relationships and trust boundaries is critical for designing appropriate access controls, authentication mechanisms, and data protection measures. ### 3.1. Identified Stakeholders and User Personas | Role | Privilege Level | Trust Level | Key Security Concerns | |-------------------------------|-----------------|------------------|--------------------------------------------------------------------------------------| | Admin | Admin | Trusted | Privilege escalation by malicious insiders, unauthorized access to sensitive company data, accidental data deletion. | | Manager | User | Partially Trusted | Mismanagement of employee shifts leading to operational risks, unauthorized access to employee data outside their company. | | Employee | User | Partially Trusted | Unauthorized shift assignments, exposure of personal data, potential manipulation of preferred shifts. | | External Optimization API | Service Account | Untrusted | Insecure API integration potentially exposing sensitive shift and employee data, lack of proper authentication mechanisms. | | Email Service Provider | Service Account | Untrusted | Phishing attacks targeting user credentials, data interception during communication. | | Monitoring and Logging Service | Service Account | Trusted | Data integrity risks in logs, unauthorized access to monitoring data which could expose system weaknesses. | | CDN/WAF | Service Account | Trusted | DDoS attacks targeting application availability, improper configuration leading to data exposure. | ### 3.2. Trust Model Trust boundaries are established at the user interface, backend server, and database levels. Security mechanisms enforcing these boundaries include user authentication methods (email/password and Google OAuth), role-based access control (RBAC) to ensure users can only access data and functionalities pertinent to their roles, and network segmentation to mitigate risks of unauthorized access. Admins have comprehensive management functions, including user and company management, while Managers can only manage employees within their designated company. Employees can only view and manage their shifts and personal data. External APIs, such as the optimization solver, have restricted access to necessary data only and are monitored closely. The principle of least privilege is implemented by granting users the minimum access necessary to perform their responsibilities, thereby reducing the risk of data exposure and privilege escalation. --- ## 4. System Architecture Analysis ### 4.1. Architectural Overview A cloud-hosted, multi-tenant web application with a responsive single-page frontend, an API gateway and backend application services that implement authentication, RBAC, scheduling logic, and optimization orchestration, a data tier for multi-tenant relational storage plus caches and object storage for exports/artifacts, and integrations to external services (email, Google OAuth, Timefold solver, monitoring). Users access the SPA via CDN/WAF; the frontend calls the API Gateway which forwards to core API services. The Optimizer component orchestrates asynchronous jobs and communicates with the Timefold solver; results are scored, validated, previewed, and committed to the primary database. Audit, monitoring, and export artifacts are retained in object storage and logs. ### 4.2. Architecture Diagram <style> svg { width: 100% !important; max-width: 100% !important; } .nodeLabel { white-space: normal !important; } </style> ```{mermaid} %%{init: {'theme':'dark'}}%% graph TB subgraph "Users & Clients" Users[Users Browsers Mobile] --> CDN end subgraph "Edge Layer" CDN[CDN & WAF] --> FE API_GW[API Gateway & Rate Limiter] FE --> API_GW API_GW --> API end subgraph "Frontend Layer" FE[Web App SPA & Admin UI] end subgraph "Application Services" API[Core API Users/Shifts/RBAC/Exports] Auth[Auth Service OAuth JWT] Scheduler[Scheduling Service & Validation] Optimizer[Optimization Orchestrator & Job Queue] Notif[Notifications & Email Worker] API --> Auth API --> Scheduler API --> Optimizer API --> Notif end subgraph "Data Layer" DB[Primary RDBMS Multi-Tenant] Cache[Redis Cache & Sessions] Object[Object Storage Exports/Artifacts] Audit[Audit Logs & Metrics] API --> DB API --> Cache API --> Object API --> Audit end subgraph "External Services" EmailSvc[Email Provider SMTP API] GoogleOAuth[Google OAuth Provider] Timefold[Timefold Optimization Solver] Monitoring[Monitoring Logging & APM] Auth --> GoogleOAuth Notif --> EmailSvc Optimizer --> Timefold Audit --> Monitoring end ``` ### 4.3. Component Breakdown | Component | Responsibility | Security Criticality | External Dependencies | |-----------|----------------|---------------------|----------------------| | Frontend Layer | Serve SPA and admin UI, render calendars... | Medium | CDN/WAF, Google OAuth | | Edge Layer (CDN & API Gateway) | Provide DDoS protection, TLS termination... | High | Managed CDN/WAF provider, API Gateway service | | Application Services | Core business logic: authentication/auth... | Critical | Google OAuth, Timefold solver | | Data Layer | Persist multi-tenant relational data, ca... | Critical | Managed RDBMS, Managed Redis | | External Services | Third-party integrations for identity, e... | High | Google OAuth Provider, Email Delivery Provider | ### 4.4. Data Flow Analysis Users fetch the SPA via CDN and interact with the UI which calls backend APIs through the API Gateway. The API authenticates requests via the Auth service (JWT/OAuth flows), applies RBAC and company scoping, and reads/writes data to the primary RDBMS. Caches (Redis) accelerate reads and sessions. Optimization requests are queued by the Optimizer, a job is created and a payload sent (securely) to Timefold; the external solver returns a solution ID and results which are polled/ingested, scored, validated, and persisted to the DB and object storage as preview artifacts. Notifications and export jobs generate artifacts in object storage and trigger audit log entries. Monitoring and audit logs stream to external observability services. ### 4.5. Attack Surface Analysis Primary entry points: public SPA and REST/WebSocket APIs via API Gateway, OAuth endpoints, email links for account verification and password resets, file export endpoints, and the async optimizer integration. Risk levels: API endpoints (High) due to sensitive operations and multi-tenant data access — mitigate with strict RBAC, per-tenant scoping, input validation, rate limits, and WAF; Auth and OAuth flows (High) — protect with secure token handling, PKCE where applicable, brute-force protections, and short-lived JWTs; Optimization integration (Medium-High) — external solver communications must use signed, minimized payloads, strict validation of returned solutions, and sandboxed parsing to prevent injection; Export and object storage endpoints (High) — protect with pre-signed URLs, access logging, role-based export permissions, and streaming/virus scanning for uploads; Email links (Medium) — use tokenized single-use links, expiration, and rate limiting to prevent account takeover; Admin consoles and tenant management (High) — require MFA and IP restrictions. Monitoring and alerting should surface anomalous patterns (failed logins, excessive export use, unexpected optimization results). Regular threat modeling, pen testing, and dependency vulnerability scanning are recommended. --- ## 5. Threat Modeling This section presents a comprehensive threat analysis of the system architecture and functional requirements. Threat modeling systematically identifies potential security vulnerabilities and attack vectors, enabling proactive risk mitigation through the application of appropriate security controls. ### 5.1. Threat Modeling Methodology This analysis employs the **STRIDE** threat modeling methodology, a systematic framework developed by Microsoft for identifying security threats across six categories: - **Spoofing Identity**: Threats involving impersonation of users or systems - **Tampering with Data**: Threats involving unauthorized modification of data or system components - **Repudiation**: Threats where users deny performing actions (lack of non-repudiation) - **Information Disclosure**: Threats involving unauthorized access to sensitive information - **Denial of Service**: Threats causing disruption or unavailability of system services - **Elevation of Privilege**: Threats allowing unauthorized access to privileged functions For each identified threat, the analysis evaluates **likelihood** (attack complexity and exposure) and **impact** (potential damage to confidentiality, integrity, or availability) to determine overall **risk level**. The methodology ensures comprehensive coverage of security concerns across all system components and interfaces. ### 5.2. Threat Analysis and Risk Assessment #### 5.2.1. Threat Overview The following table provides a quick reference of all identified threats. Detailed analysis including descriptions, mitigation strategies, and residual risk assessment (where available) is provided in the section below. | Threat ID | Component | Category | Risk Level | Likelihood | Impact | |-----------|-----------|----------|------------|-----------|--------| | THR-001 | Frontend Layer (SPA) - Calendar & Tables | Information Disclosure / Spoofing | Critical | High | High | | THR-008 | Application Services - Authentication | Spoofing | Critical | High | High | | THR-003 | Frontend Layer (Token Handling) | Spoofing / Information Disclosure | High | Medium | High | | THR-004 | Frontend Layer / External Services (Google OAuth) | Spoofing | High | Medium | High | | THR-005 | Edge Layer (CDN/WAF/TLS) | Information Disclosure / Tampering | High | Medium | High | | THR-006 | Edge Layer (WAF & API Gateway) | Tampering / Information Disclosure | High | Medium | High | | THR-009 | Application Services - Password Reset | Spoofing / Repudiation | High | Medium | High | | THR-010 | Application Services - OAuth Integration | Spoofing | High | Medium | High | | THR-011 | Application Services - RBAC / Multi-tenant Checks | Elevation of Privilege | High | Medium | High | | THR-012 | Application Services - Multi-Tenancy | Information Disclosure / Tampering | High | Medium | High | | THR-013 | Application Services - Shift APIs / DB Layer | Tampering (Injection) | High | Medium | High | | THR-014 | Auto-Assignment (Optimizer Orchestration) | Tampering / Integrity | High | Medium | High | | THR-016 | Application Services - Audit & Logging | Repudiation | High | Medium | High | | THR-017 | Data Layer - Object Storage (Exports/Artifacts) | Information Disclosure | High | Medium | High | | THR-018 | Data Layer - Managed RDBMS | Information Disclosure | High | Medium | High | | THR-020 | Data Layer - Cache/Session Store (Redis) | Spoofing / Information Disclosure | High | Medium | High | | THR-021 | External Services - Timefold Solver Integration | Information Disclosure / Tampering | High | Medium | High | | THR-022 | External Services - Timefold Solver / Solver Responses | Tampering / Elevation of Privilege | High | Medium | High | | THR-023 | External Services - Email Delivery Provider | Information Disclosure / Repudiation | High | Medium | High | | THR-024 | External Services - Google OAuth Provider | Spoofing | High | Medium | High | | THR-030 | User Interface (Cookies / Session) | Elevation of Privilege | High | Medium | High | | THR-002 | Frontend Layer & Application Services (Forms & Actions) | Tampering (CSRF) | Medium | Medium | Medium | | THR-007 | Edge Layer (Rate Limiting) | Denial of Service | Medium | Medium | Medium | | THR-015 | Application Services - Background Jobs / Queue | Denial of Service / Tampering | Medium | Medium | Medium | | THR-019 | Data Layer - Backups & Export Files | Information Disclosure | Medium | Medium | Medium | | THR-025 | External Services - Monitoring & Logging | Information Disclosure | Medium | Medium | Medium | | THR-026 | Data Export Feature (CSV/XLSX) | Tampering / Information Disclosure | Medium | Medium | Medium | | THR-027 | Auto-Assignment (Concurrency) | Tampering / Denial of Service | Medium | Medium | Medium | | THR-028 | API Gateway / Frontend Polling (Optimizer Polling) | Denial of Service | Medium | Medium | Medium | | THR-029 | Internationalization / Date-Time Handling | Tampering / Information Disclosure | Medium | Medium | Medium | **Total Threats Identified:** 30 #### 5.2.2. Detailed Threat Analysis This section provides comprehensive analysis of each identified threat, including descriptions, mitigation strategies, and residual risk assessment (where controls have been evaluated). Threats are organized by risk level for prioritized review. ##### Critical Risk Threats **THR-001** - Frontend Layer (SPA) - Calendar & Tables - **Category:** Information Disclosure / Spoofing - **Likelihood:** High | **Impact:** High - **Initial Risk Level:** Critical - **Description:** Reflected or stored XSS in UI (calendar, shift preview, user profile) allows an attacker to run JS in another user's session, exfiltrate session tokens, hijack accounts, or perform actions on behalf of the user. - **Mitigation Strategy:** Enforce output encoding/escaping on all user-supplied content; use a strict Content Security Policy (CSP) with nonces; sanitize inputs server-side and client-side, avoid innerHTML; use frameworks' safe templating; review third-party libs; run regular automated and manual XSS testing (DAST/SAST). **THR-008** - Application Services - Authentication - **Category:** Spoofing - **Likelihood:** High | **Impact:** High - **Initial Risk Level:** Critical - **Description:** Credential stuffing, weak passwords, or lack of MFA leads to account takeover of ADMIN/MANAGER accounts allowing large-scale damage. - **Mitigation Strategy:** Enforce strong password policies, rate-limit authentication attempts, use account lockouts or adaptive throttling, require MFA for privileged roles, integrate breached-password checks and anomaly detection, encourage SSO (Google) with secure config. ##### High Risk Threats **THR-003** - Frontend Layer (Token Handling) - **Category:** Spoofing / Information Disclosure - **Likelihood:** Medium | **Impact:** High - **Initial Risk Level:** High - **Description:** Session tokens or OAuth tokens stored insecurely in localStorage or accessible JS can be stolen via XSS or malicious extensions, enabling account takeover. - **Mitigation Strategy:** Use secure, httpOnly cookies with SameSite attributes for session tokens; minimize token lifetime; use token rotation and refresh tokens stored securely; implement strong CSP and XSS mitigations; detect anomalous sessions and revoke tokens. **THR-004** - Frontend Layer / External Services (Google OAuth) - **Category:** Spoofing - **Likelihood:** Medium | **Impact:** High - **Initial Risk Level:** High - **Description:** Open redirect or incorrect OAuth redirect URI validation allows attackers to capture authorization codes or tokens via a malicious callback, leading to account takeover. - **Mitigation Strategy:** Strictly validate redirect_uris against allowlist; use PKCE for OAuth flows; verify state parameter and nonce; enforce HTTPS on callback URIs; monitor for abnormal OAuth grant patterns. **THR-005** - Edge Layer (CDN/WAF/TLS) - **Category:** Information Disclosure / Tampering - **Likelihood:** Medium | **Impact:** High - **Initial Risk Level:** High - **Description:** TLS termination or CDN misconfiguration (weak ciphers, expired certs, missing HSTS) could allow MitM, protocol downgrade, or data interception between clients and edge. - **Mitigation Strategy:** Enforce strong TLS configuration (TLS1.2+ recommended, prefer 1.3), HSTS, secure certificate lifecycle management, automate renewals, monitor TLS telemetry, enable HTTP Strict Transport Security, and perform periodic TLS scans. **THR-006** - Edge Layer (WAF & API Gateway) - **Category:** Tampering / Information Disclosure - **Likelihood:** Medium | **Impact:** High - **Initial Risk Level:** High - **Description:** WAF rule bypass or insufficient WAF rules allow injection payloads (SQLi, XSS) to reach backend; misconfigured gateway could leak internal details via verbose errors. - **Mitigation Strategy:** Implement layered WAF rules including OWASP top 10 protections; use positive allowlists for APIs; sanitize error messages; enable anomaly detection and tuning; use gateway-level request validation and schema checks. **THR-009** - Application Services - Password Reset - **Category:** Spoofing / Repudiation - **Likelihood:** Medium | **Impact:** High - **Initial Risk Level:** High - **Description:** Weak or predictable password reset tokens, or emails sent with insufficient verification, allow attackers to reset passwords and take over accounts. - **Mitigation Strategy:** Use long, cryptographically secure, single-use tokens with short TTL; bind token to user agent/IP metadata; log and notify users of resets; rate limit reset requests; verify identity for high-privilege resets; avoid leaking account existence info. **THR-010** - Application Services - OAuth Integration - **Category:** Spoofing - **Likelihood:** Medium | **Impact:** High - **Initial Risk Level:** High - **Description:** Compromised or replayed OAuth tokens from Google OAuth could be used to impersonate users if token validation is insufficient. - **Mitigation Strategy:** Validate ID token signatures and claims server-side; check token expiry and audience; implement token revocation and rotation; use PKCE and state parameters; map OAuth identities carefully to internal accounts with additional checks for privileged ops. **THR-011** - Application Services - RBAC / Multi-tenant Checks - **Category:** Elevation of Privilege - **Likelihood:** Medium | **Impact:** High - **Initial Risk Level:** High - **Description:** Broken access control or insufficient tenant scoping may allow a manager/admin/employee to view or modify data for other companies or elevate privileges. - **Mitigation Strategy:** Implement centralized, fine-grained RBAC and tenant authorization checks on the server side (deny-by-default); perform authorization at every entry point; use automated tests for tenant isolation; include ABAC claims (tenant_id, role) in tokens and validate them server-side. **THR-012** - Application Services - Multi-Tenancy - **Category:** Information Disclosure / Tampering - **Likelihood:** Medium | **Impact:** High - **Initial Risk Level:** High - **Description:** Data leakage across tenants due to incorrect SQL queries, shared caches, or improper tenant-scoped identifiers could expose PII and shift data of other companies. - **Mitigation Strategy:** Use strict tenant_id scoping in queries, prepared statements, row-level security or separate schemas per tenant if appropriate; segregate caches (prefix keys by tenant_id), encrypt data at rest, review multi-tenant design in threat model. **THR-013** - Application Services - Shift APIs / DB Layer - **Category:** Tampering (Injection) - **Likelihood:** Medium | **Impact:** High - **Initial Risk Level:** High - **Description:** SQL injection, NoSQL injection or command injection via poorly validated parameters (search, filtering, sorting) could lead to data theft or corruption. - **Mitigation Strategy:** Use parameterized queries/ORMs, input validation and canonicalization, allowlist sorting/filtering fields, use least privilege DB accounts, run SAST and SQLi testing, employ web application firewall rules tailored to injections. **THR-014** - Auto-Assignment (Optimizer Orchestration) - **Category:** Tampering / Integrity - **Likelihood:** Medium | **Impact:** High - **Initial Risk Level:** High - **Description:** An attacker could manipulate optimization payloads, acceptance flow, or solver responses (malformed or malicious solution) to force incorrect assignments (e.g., assign unauthorized employees to shifts) or bypass constraints. - **Mitigation Strategy:** Sign and validate payloads and responses; use mutual TLS or API keys with IP allowlisting for Timefold; validate solver results against business rules server-side; sandbox and review solutions; require manager approval for critical changes; maintain an immutable audit trail. **THR-016** - Application Services - Audit & Logging - **Category:** Repudiation - **Likelihood:** Medium | **Impact:** High - **Initial Risk Level:** High - **Description:** Insufficient or tamperable audit logs allow malicious actors to erase traces of actions (shift changes, acceptance) or administrators to repudiate actions. - **Mitigation Strategy:** Append-only audit logs, write to immutable storage or WORM-enabled object storage, centralize logs to a managed SIEM, sign or hash log entries, restrict log access, and monitor for log deletion events. **THR-017** - Data Layer - Object Storage (Exports/Artifacts) - **Category:** Information Disclosure - **Likelihood:** Medium | **Impact:** High - **Initial Risk Level:** High - **Description:** Misconfigured S3-like buckets or signed URLs with overly long TTLs could leak CSV/XLSX exports or optimizer artifacts publicly, exposing PII and shift data. - **Mitigation Strategy:** Enforce bucket policies denying public access, use short-lived signed URLs, server-side access control by tenant, encrypt objects at rest, log and monitor object access, and scan object buckets for public exposure. **THR-018** - Data Layer - Managed RDBMS - **Category:** Information Disclosure - **Likelihood:** Medium | **Impact:** High - **Initial Risk Level:** High - **Description:** Database credentials stored insecurely (in code, misconfigured secrets management) or overly-permissive DB accounts allow attackers or insiders to dump tenant data. - **Mitigation Strategy:** Use managed secrets (KMS/Secret Manager), rotate credentials regularly, enforce least privilege DB roles, network isolate DB (VPC), enable encryption at rest, enable DB auditing, and use IAM-based auth where available. **THR-020** - Data Layer - Cache/Session Store (Redis) - **Category:** Spoofing / Information Disclosure - **Likelihood:** Medium | **Impact:** High - **Initial Risk Level:** High - **Description:** Compromise of cache/session store could allow theft of session tokens or tenant-scoped cached data, enabling session hijacking or data leakage. - **Mitigation Strategy:** Network-restrict access to cache (VPC security groups), enable AUTH and TLS on Redis, do not store long-lived secrets in cache, rotate session tokens and invalidate sessions on suspicious activity, isolate keys per tenant, and monitor access. **THR-021** - External Services - Timefold Solver Integration - **Category:** Information Disclosure / Tampering - **Likelihood:** Medium | **Impact:** High - **Initial Risk Level:** High - **Description:** Sensitive optimization payloads (employee availability, leave, skills) transmitted to or stored by the external solver may be exposed if the external service is compromised or communication is intercepted. - **Mitigation Strategy:** Minimize sensitive data sent to external solver; use strong transport security (mTLS), enable payload encryption where possible, contractually require security controls from provider, implement data minimization and anonymization, and maintain an audit of payloads sent. **THR-022** - External Services - Timefold Solver / Solver Responses - **Category:** Tampering / Elevation of Privilege - **Likelihood:** Medium | **Impact:** High - **Initial Risk Level:** High - **Description:** Malicious or malformed solver responses could instruct the application to create invalid/privileged assignments or bypass constraints if insufficiently validated. - **Mitigation Strategy:** Validate solver outputs against server-side business rules and constraints before applying; require manager acceptance for significant changes; verify score integrity; sandbox parsing logic and implement strict schema validation for responses. **THR-023** - External Services - Email Delivery Provider - **Category:** Information Disclosure / Repudiation - **Likelihood:** Medium | **Impact:** High - **Initial Risk Level:** High - **Description:** Compromised email provider or mis-sent transactional emails (password resets, verification) can be used for phishing or account takeover or accidental leakage of PII. - **Mitigation Strategy:** Use a reputable provider with security SLAs; sign emails (DKIM/SPF/DMARC), limit PII in emails, use templated safe content, rate-limit mass emails, monitor bounce/reputation, and provide out-of-band verification for critical operations. **THR-024** - External Services - Google OAuth Provider - **Category:** Spoofing - **Likelihood:** Medium | **Impact:** High - **Initial Risk Level:** High - **Description:** Compromise of Google OAuth accounts or misconfiguration (improperly mapped accounts) allowing attackers to authenticate as other users or link accounts incorrectly. - **Mitigation Strategy:** Implement verification steps when linking OAuth accounts; check verified email claims; require additional verification for privileged role assignment; detect and alert on suspicious OAuth logins (new IP/geo), and support account unlinking and emergency access removal. **THR-030** - User Interface (Cookies / Session) - **Category:** Elevation of Privilege - **Likelihood:** Medium | **Impact:** High - **Initial Risk Level:** High - **Description:** XSS or insecure cookie settings allow session cookie theft leading to privilege escalation (e.g., attacker operates as manager/admin). - **Mitigation Strategy:** Use httpOnly and Secure cookies with SameSite attributes, rotate sessions on privilege changes, provide session management UI for users, invalidate sessions on suspicious activity, and enforce MFA for privileged actions. ##### Medium Risk Threats **THR-002** - Frontend Layer & Application Services (Forms & Actions) - **Category:** Tampering (CSRF) - **Likelihood:** Medium | **Impact:** Medium - **Initial Risk Level:** Medium - **Description:** Cross-Site Request Forgery: authenticated users could be induced to submit state-changing requests (assignments, accept generated shifts) from another origin. - **Mitigation Strategy:** Implement anti-CSRF tokens on state-changing endpoints or use SameSite=strict/strictish cookies for session tokens; require explicit user confirmation for risky ops (e.g., commit auto-assignment); validate Origin/Referer headers; use CORS allowlist. **THR-007** - Edge Layer (Rate Limiting) - **Category:** Denial of Service - **Likelihood:** Medium | **Impact:** Medium - **Initial Risk Level:** Medium - **Description:** Absence or weak rate limiting allows brute-force, enumeration, or abusive polling (e.g., optimizer polling) causing backend overload or service degradation. - **Mitigation Strategy:** Apply per-IP, per-user, and per-endpoint rate limits; exponential backoff; CAPTCHAs for suspicious flows (login); token bucket throttling; protect long-polling endpoints with quotas; monitor metrics and alert on spikes. **THR-015** - Application Services - Background Jobs / Queue - **Category:** Denial of Service / Tampering - **Likelihood:** Medium | **Impact:** Medium - **Initial Risk Level:** Medium - **Description:** Queue or job system abuse (poisoned jobs, replayed jobs, or malformed payloads) can cause failures in optimizer orchestration, duplicate processing, or resource exhaustion. - **Mitigation Strategy:** Validate and sanitize queued payloads, enforce max job size and rate limits, implement dead-letter queues and idempotency tokens, use job signing or auth, monitor queue depth and job error rates, and use per-tenant job quotas. **THR-019** - Data Layer - Backups & Export Files - **Category:** Information Disclosure - **Likelihood:** Medium | **Impact:** Medium - **Initial Risk Level:** Medium - **Description:** Backups, exported CSV/XLSX, or optimizer artifacts containing PII may be retained insecurely or sent to external systems without encryption, leading to data leakage. - **Mitigation Strategy:** Encrypt backups and exports at rest and in transit, restrict access to backups, apply retention and deletion policies, sanitize exports (redact sensitive fields when possible), and log export/download events per tenant. **THR-025** - External Services - Monitoring & Logging - **Category:** Information Disclosure - **Likelihood:** Medium | **Impact:** Medium - **Initial Risk Level:** Medium - **Description:** Sensitive data (PII, tokens) in logs or monitoring metrics sent to third-party services may leak across organizations or be accessible to unauthorized parties. - **Mitigation Strategy:** Redact or mask PII/tokens before sending to logs; use sampling and data minimization; restrict access to monitoring dashboards; apply retention policies; use encryption for logs in transit and at rest. **THR-026** - Data Export Feature (CSV/XLSX) - **Category:** Tampering / Information Disclosure - **Likelihood:** Medium | **Impact:** Medium - **Initial Risk Level:** Medium - **Description:** Exported spreadsheets containing user-entered fields could include CSV injection (formula injection) or contain sensitive PII unexpectedly; exported files may be downloaded using unsecured links. - **Mitigation Strategy:** Sanitize cell content (prefix ' or use safe formatting to avoid formula execution), require authentication to download, use short-lived signed URLs, perform pre-export redaction options, and log export events per user and tenant. **THR-027** - Auto-Assignment (Concurrency) - **Category:** Tampering / Denial of Service - **Likelihood:** Medium | **Impact:** Medium - **Initial Risk Level:** Medium - **Description:** Race conditions between auto-assignment job acceptance and manual edits can create duplicate shifts, gaps, or inconsistent state across tenants. - **Mitigation Strategy:** Use transactional operations, optimistic concurrency control (versioning), idempotency tokens for operations, and perform final validation before commit; provide conflict resolution UI and alerting. **THR-028** - API Gateway / Frontend Polling (Optimizer Polling) - **Category:** Denial of Service - **Likelihood:** Medium | **Impact:** Medium - **Initial Risk Level:** Medium - **Description:** Abuse of real-time polling endpoints (frequent polling for optimization status) can overwhelm backend services, increasing costs and causing outages. - **Mitigation Strategy:** Implement backoff, push mechanisms (WebSockets/Server-Sent Events) with authenticated subscribe, enforce polling rate limits, introduce caching for status, and apply quotas per tenant. **THR-029** - Internationalization / Date-Time Handling - **Category:** Tampering / Information Disclosure - **Likelihood:** Medium | **Impact:** Medium - **Initial Risk Level:** Medium - **Description:** Locale and timezone misparsing or injection of malformed locale strings could cause incorrect shift calculations, exposing different tenants' data or mis-scheduling employees. - **Mitigation Strategy:** Normalize and validate all locale/timezone inputs against known allowlists, store all times in UTC and render locale-aware only in UI, add unit and integration tests for date conversions, and log unexpected locale values. *Note: Residual risk assessment will be calculated after controls are implemented. Once security controls are implemented, this section will show the effectiveness of controls and the resulting residual risk levels.* ### 5.3. Risk Summary Critical threats center on authentication/authorization failures, multi-tenant isolation errors, and injection/XSS allowing account takeover or cross-tenant data exposure. Attackers' primary entry points are the frontend (XSS, token storage), authentication flows (credential stuffing, OAuth misconfig), the API gateway (injection and WAF bypass), and external integrations (Timefold, email, OAuth). The highest-risk items requiring immediate attention are: (1) XSS leading to session theft (THR-001), (2) credential-based account takeover and lack of MFA for privileged roles (THR-008), (3) broken RBAC / tenant isolation allowing cross-tenant access (THR-011/THR-012), (4) SQL/command injection and WAF bypass (THR-013/THR-006), and (5) leakage of exports/optimizer payloads via misconfigured object storage or external services (THR-017/THR-021). Overall posture is medium-to-high risk until core controls are implemented: robust server-side authorization and tenant scoping, secure authentication (MFA, strong password policy, OAuth hardening), comprehensive input validation and encoding (prevent XSS/SQLi), secure token handling, network and secrets hygiene, and strict controls for third-party integrations. Priorities: implement strong RBAC and tenancy enforcement, fix XSS vectors and switch to httpOnly secure cookies, enable MFA, enforce parameterized queries and WAF rules, harden edge TLS and rate limiting, encrypt and restrict access to backups/exports, and secure external solver integrations with mTLS and payload validation. Regular controls to deploy: threat-aware secure coding, SAST/DAST, fuzzing/testing around date/time/locale handling, blue/green deployments with security gating, incident detection/response capabilities, and contractual + technical risk controls for third-party providers. --- ## 6. Multi-Standard Security Requirements Mapping This section maps each functional requirement to specific security controls from multiple industry standards: OWASP Application Security Verification Standard (ASVS), NIST SP 800-53 Rev 5, and ISO 27001:2022. This multi-standard approach provides comprehensive coverage across application-level, enterprise-level, and organizational-level security domains: - **OWASP ASVS**: Application-level security controls (code, APIs, authentication, session management) - **NIST SP 800-53**: Enterprise security controls (governance, risk management, incident response) - **ISO 27001**: Information security management controls (policies, procedures, organizational controls) Requirements are prioritized based on risk assessment and compliance needs, with controls selected from the most appropriate standard(s) for each requirement type. ### 6.1. Recommended ASVS Compliance Level **Recommended Level:** L2 **Level 2: Standard** Recommended for most production applications. Provides comprehensive security coverage suitable for applications handling sensitive data or operating in regulated environments. Includes controls for authentication, authorization, data protection, and secure communications. The recommendation considers factors such as: - Data sensitivity and classification levels - Regulatory and compliance requirements (GDPR, HIPAA, PCI-DSS, etc.) - Threat landscape and risk assessment from threat modeling - Business criticality and potential impact of security incidents All security controls referenced in this document align with this recommended compliance level. ### 6.2. Requirements Mapping This section maps each high-level requirement to specific security controls from multiple standards (OWASP ASVS, NIST SP 800-53, ISO 27001) with detailed descriptions, relevance explanations, and integration guidance. Controls are grouped by standard for clarity. #### 6.2.1. REQ-001: User registration with email verification and account lifecycle management ##### OWASP ASVS Controls **V2.1** **Requirement:** Verify new user registrations via email or other out-of-band mechanisms to ensure account ownership. **Relevance:** Directly addresses the need to confirm user ownership of email accounts during registration and reduces fraudulent account creation. It maps to the verification and lifecycle control aspects of the requirement. **Integration Tips:** Implement email confirmation tokens that are single-use and time-limited; require confirmation before enabling privileged features. Tie the verification status to account state in the user lifecycle management flows. **Verification Method:** Review implementation of email verification flow, inspect token properties (single-use, expiry), and test account behavior before and after verification. **Level:** L1 | **Priority:** Critical ##### NIST SP 800-53 Controls **AC-2** **Requirement:** The organization manages information system accounts, including account creation, enablement, modification, disabling, and removal. **Relevance:** Specifies lifecycle operations which map to registration, activation, suspension, and removal of user accounts required by the feature. **Integration Tips:** Establish automated workflows and approval steps for account creation and deactivation; maintain authoritative records of account states and reason codes. **Verification Method:** Audit account management procedures, review logs of account create/disable/delete events, and verify policy enforcement through test cases. **Priority:** Critical **IA-5** **Requirement:** Manage, distribute, and revoke credentials and authenticators throughout the account lifecycle. **Relevance:** Addresses credential issuance and revocation tied to account lifecycle which complements email verification and lifecycle management. **Integration Tips:** Implement credential issuance policies, track authenticator provenance, and ensure revocation paths (e.g., when email changes or accounts disabled). **Verification Method:** Review credential lifecycle processes, test revocation and re-issuance flows, and inspect logs for authenticator events. **Priority:** High ##### ISO 27001:2022 Controls **A.9.2.1** **Requirement:** A formal user registration and de-registration process shall be implemented to enable assignment of access rights. **Relevance:** Mandates a formal process for onboarding/offboarding which ensures registration ties into access rights and lifecycle. **Integration Tips:** Document procedures for registration and de-registration, include steps for verification, approvals, and role assignment during onboarding/offboarding. **Verification Method:** Inspect documented procedures and sample records for adherence; validate that de-registration revokes access promptly. **Priority:** High #### 6.2.2. REQ-002: Authentication and single sign-on via credentials and Google OAuth ##### OWASP ASVS Controls **V2.2** **Requirement:** Support secure authentication including credential-based and federated authentication (OAuth2, OpenID Connect) with proper validation and token handling. **Relevance:** Directly covers secure handling of credential-based login and federated SSO (Google OAuth) required by the requirement. **Integration Tips:** Use well-vetted OAuth2/OpenID Connect libraries, validate ID tokens server-side, enforce scopes and claims, and handle token storage securely. **Verification Method:** Review OAuth/OIDC implementation, verify token validation, scope restrictions, and perform token replay/forgery tests. **Level:** L2 | **Priority:** Critical **V5.3** **Requirement:** Ensure tokens are validated, scoped, stored securely, and revoked when necessary for SSO and OAuth use-cases. **Relevance:** Covers secure token lifecycle for SSO, ensuring tokens from Google are handled safely and revocable. **Integration Tips:** Use secure token storage (HTTP-only cookies or secure token stores), implement token revocation and rotation, and minimize token scopes. **Verification Method:** Inspect token storage methods, test revocation and refresh flows, and review scope requests during OAuth handshake. **Level:** L2 | **Priority:** Critical ##### NIST SP 800-53 Controls **IA-2** **Requirement:** Identify and authenticate organizational users using authenticators and, where appropriate, federated identity mechanisms. **Relevance:** Provides organizational control guidance for authenticating users via both local credentials and federated providers like Google. **Integration Tips:** Define acceptable authenticators, document trust relationships with identity providers, and require secure channels for federation. **Verification Method:** Examine policies for federated identity, test SSO flows for proper authentication, and verify credential handling meets organizational standards. **Priority:** Critical ##### ISO 27001:2022 Controls **A.9.4.2** **Requirement:** Secure log-on procedures shall be implemented, where appropriate supporting single sign-on and federated identity. **Relevance:** Requires secure log-on procedures and supports SSO, aligning with the need for secure Google OAuth integration. **Integration Tips:** Implement SSO with secure session establishment, multi-factor option where required, and maintain centralized session policies. **Verification Method:** Validate the log-on workflow, verify session creation after SSO, and review session timeout and logout behavior. **Priority:** High #### 6.2.3. REQ-003: Password reset and account recovery ##### OWASP ASVS Controls **V2.3** **Requirement:** Implement secure password reset flows using verified contact channels and protections against account takeover (OTP, expiring tokens, rate limiting). **Relevance:** Directly maps to the need for secure password reset flows and protections against abuse or account takeover. **Integration Tips:** Use single-use, short-lived reset tokens delivered via verified channels, add rate limiting and anomaly detection on reset attempts. **Verification Method:** Test reset flows for token reuse, expiry, and ensure resets require verified contact; perform abuse-case testing. **Level:** L1 | **Priority:** Critical **V5.1** **Requirement:** Recovery tokens and one-time use links must be single-use, short-lived, and protected against replay attacks. **Relevance:** Specifies properties of recovery tokens which mitigate replay and abuse in password reset flows. **Integration Tips:** Implement cryptographically-random tokens, mark tokens used after redemption, and expire tokens quickly (e.g., 15 minutes). **Verification Method:** Inspect token generation and storage, attempt token replay tests, and verify expiry enforcement. **Level:** L2 | **Priority:** High ##### NIST SP 800-53 Controls **IA-5 (5)** **Requirement:** Establish policies and mechanisms for managing password resets and recovery in a manner that resists credential compromise. **Relevance:** Provides organizational expectations for secure recovery procedures to reduce risk of credential compromise. **Integration Tips:** Document recovery procedures, require multi-step verification for high-risk account changes, and log recovery events for auditing. **Verification Method:** Review recovery policies, validate multi-step verification for sensitive accounts, and inspect logs of recovery events. **Priority:** High ##### ISO 27001:2022 Controls **A.9.2.3** **Requirement:** Ensure controlled management of authentication data and password resets, including policies and procedures. **Relevance:** Supports governance over reset and recovery processes to prevent misuse, particularly for privileged accounts. **Integration Tips:** Apply stricter reset controls for privileged roles, require manual approvals where appropriate, and log privileged resets. **Verification Method:** Review privileged reset controls, sampling of privileged account reset logs, and policy documentation. **Priority:** Medium #### 6.2.4. REQ-004: Role-based access control (ADMIN, MANAGER, EMPLOYEE) and user status management ##### OWASP ASVS Controls **V4.1** **Requirement:** Enforce role-based access control with least privilege and separation of duties; implement role checks on both client and server sides. **Relevance:** Directly prescribes RBAC enforcement necessary for ADMIN/MANAGER/EMPLOYEE roles and ensures server-side enforcement to prevent privilege escalation. **Integration Tips:** Centralize role checks in authorization middleware, enforce least privilege for each role, and prevent client-side-only enforcement. **Verification Method:** Review role definitions, test access control enforcement across endpoints for each role, and perform privilege escalation attempts. **Level:** L2 | **Priority:** Critical ##### NIST SP 800-53 Controls **AC-3** **Requirement:** Enforce access restrictions and ensure users are granted access only to authorized functions and data. **Relevance:** Mandates access enforcement which supports role-based controls and status-based access (active/disabled/suspended). **Integration Tips:** Implement centralized access control checks, map roles to permissions, and enforce account status checks before granting access. **Verification Method:** Inspect policy-to-implementation mapping, run access matrix tests, and verify that disabled users cannot access resources. **Priority:** Critical **AC-2 (3)** **Requirement:** Automate account status changes (enable/disable) and maintain authoritative account state. **Relevance:** Supports user status management by prescribing automation and authoritative state control to prevent orphaned or active-but-disabled accounts. **Integration Tips:** Integrate with HR systems for status changes, implement automated disabling for inactivity or termination, and record change reasons. **Verification Method:** Audit automation integrations, simulate HR-driven status changes, and verify system enforces new statuses immediately. **Priority:** High ##### ISO 27001:2022 Controls **A.9.1.2** **Requirement:** An access control policy based on business and security requirements shall be established, documented, and reviewed. **Relevance:** Requires documented access control policies to define role responsibilities and status management. **Integration Tips:** Create and maintain an access control policy describing roles, permissions, and lifecycle procedures; align with HR onboarding/offboarding. **Verification Method:** Review access control policy documentation and interview personnel to confirm implementation. **Priority:** High #### 6.2.5. REQ-005: User profile management and company assignment ##### OWASP ASVS Controls **V4.6** **Requirement:** Verify that updates to user profiles and assignments (e.g., company membership) are protected by server-side authorization checks. **Relevance:** Directly addresses the need to protect profile updates and company assignments from unauthorized changes. **Integration Tips:** Enforce server-side permission checks tied to role and ownership; validate company assignment changes against authoritative sources. **Verification Method:** Review code paths for profile update endpoints, perform unauthorized modification tests, and inspect audit logs. **Level:** L1 | **Priority:** High **V1.1** **Requirement:** Design systems to maintain clear trust boundaries so profile attributes that determine access are authoritative and validated. **Relevance:** Ensures profile attributes like company assignment are authoritative and cannot be spoofed to gain access across boundaries. **Integration Tips:** Store canonical profile attributes in a trusted service or database, and validate tokens/claims used to assert company membership. **Verification Method:** Inspect trust boundary design, review data flow diagrams, and test for attribute spoofing. **Level:** L2 | **Priority:** High ##### NIST SP 800-53 Controls **AC-6** **Requirement:** Employ least privilege mechanisms for user profile updates and assignment of organizational attributes. **Relevance:** Ensures only authorized personnel or processes can assign users to companies or alter profile attributes, reducing risk of misuse. **Integration Tips:** Assign minimal privileges to services and operators that manage profile/company attributes and require approvals for sensitive changes. **Verification Method:** Check privilege assignments for profile-management components and test unauthorized assignment attempts. **Priority:** High ##### ISO 27001:2022 Controls **A.9.2.2** **Requirement:** A formal process for granting and revoking access rights and attributes should be followed, including assignment to organizational units. **Relevance:** Requires formal provisioning processes which should include company assignment and profile attribute handling. **Integration Tips:** Implement provisioning workflows with approvals and record keeping, and enforce verification of company membership during assignment. **Verification Method:** Review provisioning records and test the end-to-end process for correctness and auditability. **Priority:** Medium #### 6.2.6. REQ-006: Company CRUD and multi-tenant scoping of data ##### OWASP ASVS Controls **V14.1** **Requirement:** Ensure logical separation of tenant data and enforce access controls to prevent cross-tenant data leakage. **Relevance:** Directly addresses multi-tenant scoping and the need to prevent cross-company data access when performing CRUD operations. **Integration Tips:** Enforce tenant checks at data access layer and include tenant_id in every query predicate; implement row-level security where possible. **Verification Method:** Review data access code, run multi-tenant isolation tests (attempt cross-tenant reads/writes), and inspect database policies. **Level:** L2 | **Priority:** Critical ##### NIST SP 800-53 Controls **SC-7** **Requirement:** Implement controls to separate and protect system components and data flows; apply isolation as necessary. **Relevance:** Supports the requirement to protect and isolate tenant data by prescribing boundary and isolation controls. **Integration Tips:** Segment logical components by tenant boundaries, apply network and access controls for management interfaces, and minimize shared state. **Verification Method:** Assess architecture diagrams, test separation of management interfaces, and review network segmentation controls. **Priority:** High **AC-6 (10)** **Requirement:** Apply tenant-specific access restrictions and scoping to limit access to tenant resources. **Relevance:** Specifies tailoring of least-privilege controls to tenant-specific resources which is essential for company CRUD scoping. **Integration Tips:** Map permissions to tenant-scoped roles, implement enforcement in APIs and DB, and maintain per-tenant admin scopes. **Verification Method:** Verify per-tenant role mappings, test scoped permissions, and run negative tests attempting cross-tenant CRUD. **Priority:** High ##### ISO 27001:2022 Controls **A.13.2.1** **Requirement:** Information transfer and segregation mechanisms should be defined to protect the exchange and separation of information between entities. **Relevance:** Requires documented segregation mechanisms relevant to multi-tenant CRUD operations and data transfer between tenants. **Integration Tips:** Document transfer policies, implement enforcement controls for inter-tenant transfers, and require approvals for cross-tenant data export. **Verification Method:** Review policy documents and sample transfer approvals; test that transfers are blocked or logged when not permitted. **Priority:** Medium #### 6.2.7. REQ-007: Shift type management with time ranges and required skills ##### OWASP ASVS Controls **V1.3** **Requirement:** Validate business input (e.g., time ranges, required skills) server-side to prevent logic abuse and ensure data integrity. **Relevance:** Protects shift-type definitions from malformed or malicious inputs that could break scheduling logic or grant unauthorized capabilities. **Integration Tips:** Implement strict server-side validation for time ranges, enforce constraints (no overlap, valid skill IDs), and canonicalize inputs. **Verification Method:** Review validation code, perform fuzzing of time/skill inputs, and check DB for invalid persisted records. **Level:** L1 | **Priority:** High **V6.4** **Requirement:** Ensure business logic (e.g., required skills per shift type) is enforced server-side and cannot be bypassed by client manipulation. **Relevance:** Directly ensures shift-type business rules are enforced server-side to prevent client-side tampering. **Integration Tips:** Centralize business rules in service layer, implement tests for rule enforcement, and prevent direct DB writes that bypass logic. **Verification Method:** Attempt to bypass rules via direct API/DB calls and validate server rejects inconsistent or unauthorized changes. **Level:** L2 | **Priority:** High ##### NIST SP 800-53 Controls **SI-10** **Requirement:** Employ integrity checks and input validation to ensure data consistency and correctness. **Relevance:** Ensures integrity of shift-type data and supports detection of tampering or corruption. **Integration Tips:** Apply schema validation, integrity checksums where necessary, and enforce business rule validation in services. **Verification Method:** Inspect schema validations, run integrity checks in test harness, and verify constraints via unit tests. **Priority:** Medium ##### ISO 27001:2022 Controls **A.12.1.2** **Requirement:** Changes to systems and data (including configuration of business objects like shift types) should be controlled to preserve integrity. **Relevance:** Requires controlled change processes for shift-type configurations to prevent unauthorized or erroneous changes. **Integration Tips:** Use controlled deployment/change processes for shift-type schema or rule changes, include review/approval steps for business-impacting changes. **Verification Method:** Review change records for shift-type modifications and check that approvals were captured. **Priority:** Medium #### 6.2.8. REQ-008: Manual shift creation, update, deletion, and calendar presentation ##### OWASP ASVS Controls **V4.4** **Requirement:** Authorize all modification endpoints and verify checks server-side to prevent unauthorized creation, update, or deletion. **Relevance:** Ensures only authorized users can create/update/delete shifts, which is central to manual shift management. **Integration Tips:** Protect endpoints via role checks and ownership checks; ensure calendar UI actions invoke server-side authorization. **Verification Method:** Test role-based access to create/update/delete endpoints, and attempt unauthorized operations. **Level:** L1 | **Priority:** Critical ##### NIST SP 800-53 Controls **AU-2** **Requirement:** Determine and log auditable events including create, modify, delete operations. **Relevance:** Records manual shift changes for accountability and incident investigation as required by the feature. **Integration Tips:** Log change events with user, timestamp, before/after state and reason; protect logs from tampering. **Verification Method:** Review audit logs for shift CRUD events and validate completeness and integrity. **Priority:** High **AC-6** **Requirement:** Restrict modify/delete/create operations to roles with explicit permissions. **Relevance:** Supports limiting who may perform manual shift operations to defined roles, reducing misuse risk. **Integration Tips:** Map CRUD permissions to ADMIN/MANAGER roles and apply checks in API and UI layers. **Verification Method:** Review permission mappings and test that lower-privileged roles cannot modify shifts. **Priority:** High ##### ISO 27001:2022 Controls **A.12.4.1** **Requirement:** Event logs recording user activities, exceptions, and security events shall be produced and retained. **Relevance:** Mandates retaining logs for manual shift operations and UI interactions for compliance and troubleshooting. **Integration Tips:** Define retention periods, ensure secure storage, and include calendar-related events as auditable actions. **Verification Method:** Inspect logs for the required events, retention configuration, and access controls around logs. **Priority:** Medium #### 6.2.9. REQ-009: Shift status tracking and filtering (SCHEDULED, CONFIRMED, COMPLETED, CANCELLED, NO_SHOW) ##### OWASP ASVS Controls **V10.1** **Requirement:** Ensure logs and status transitions are recorded in tamper-resistant logs and integrity-protected storage. **Relevance:** Protects the integrity of status history to provide trustworthy records for scheduling outcomes. **Integration Tips:** Use append-only logs or secure log storage with integrity checks and restrict log modification privileges. **Verification Method:** Inspect log storage protections and attempt to modify logs; verify detection of tamper attempts. **Level:** L2 | **Priority:** High ##### NIST SP 800-53 Controls **AU-6** **Requirement:** Regularly review and analyze audit records for indications of unauthorized activity or changes. **Relevance:** Encourages review of status transitions to detect unauthorized or anomalous status changes such as NO_SHOW flags being manipulated. **Integration Tips:** Log status transitions with actor and context, implement periodic reviews and alerts for unusual patterns. **Verification Method:** Review audit processes, sample status transition logs, and ensure alerts are configured for anomalies. **Priority:** High **CM-3** **Requirement:** Control and document changes to system configuration and state transitions. **Relevance:** Ensures system state transitions for shift statuses are controlled and documented, preventing unauthorized state changes. **Integration Tips:** Treat status transition rules as configuration items, version them, and require approvals for rule changes. **Verification Method:** Review change records for status transition rule updates and verify approvals were enforced. **Priority:** Medium ##### ISO 27001:2022 Controls **A.12.4.3** **Requirement:** Administrator and operator activities, including status changes, should be logged and reviewed. **Relevance:** Mandates logging of operator actions affecting shift statuses to maintain accountability. **Integration Tips:** Capture operator ID and reason for manual status changes, and include review procedures for sensitive transitions. **Verification Method:** Check logs for operator entries and review processes for manual status changes. **Priority:** Medium #### 6.2.10. REQ-010: Automated shift assignment (auto-assignment) via external solver with preview and accept/reject ##### OWASP ASVS Controls **V13.1** **Requirement:** Securely integrate with third-party APIs using mutual authentication, input/output validation, and secure error handling. **Relevance:** Applies to integrating with external solver for auto-assignment and ensuring previews and accepts/rejects are securely transmitted and validated. **Integration Tips:** Use mutual TLS or OAuth for API calls, validate solver responses before applying changes, and implement signed payloads or record hashes for integrity. **Verification Method:** Review API authentication configuration, test injection or malformed response handling, and verify server validates solver outputs. **Level:** L2 | **Priority:** Critical ##### NIST SP 800-53 Controls **SA-9** **Requirement:** Ensure that external interfaces are secured and that integration with external systems follows organizational policies. **Relevance:** Mandates governance around external solver usage and how solver results are accepted into the system. **Integration Tips:** Define security requirements in supplier agreements, document expected APIs, and ensure change management for solver integration. **Verification Method:** Review supplier contracts, interface security documentation, and test compliance with the defined integration policy. **Priority:** High **SC-8** **Requirement:** Protect the confidentiality and integrity of information during transmission to external services. **Relevance:** Ensures solver payloads and returned solutions are transmitted securely to prevent tampering or eavesdropping. **Integration Tips:** Use TLS with strong ciphers, enforce certificate validation, and consider payload signing for end-to-end integrity. **Verification Method:** Inspect TLS configuration, perform MITM tests, and verify payload signatures if implemented. **Priority:** High ##### ISO 27001:2022 Controls **A.15.1.1** **Requirement:** Establish controls for supplier relationships including security requirements for shared data and interfaces. **Relevance:** Supports contractual and security requirements for using an external solver service for assignments. **Integration Tips:** Include SLAs and security requirements in supplier agreements, require proof of secure handling, and define incident responsibilities. **Verification Method:** Inspect supplier agreements and evidence of supplier security practices and audits. **Priority:** Medium #### 6.2.11. REQ-011: Real-time asynchronous job processing, polling, and solution status tracking ##### OWASP ASVS Controls **V14.3** **Requirement:** Ensure job queues and background processing components enforce authentication, authorization, and message validation. **Relevance:** Specifies securing job processing elements to ensure only authorized jobs are enqueued/processed and status updates are validated. **Integration Tips:** Authenticate producers/consumers, validate job payloads schema, and authorize status-change operations based on role. **Verification Method:** Inspect queue ACLs, test unauthorized enqueue/dequeue attempts, and validate payload schema checks. **Level:** L2 | **Priority:** Critical ##### NIST SP 800-53 Controls **SC-13** **Requirement:** Use cryptography to protect data in transit and at rest in asynchronous messaging systems. **Relevance:** Secures messages and job payloads in transit and at rest as they move through job queues and polling endpoints. **Integration Tips:** Encrypt messages in transit with TLS and at rest with appropriate encryption keys; protect queue access with authentication. **Verification Method:** Review encryption configurations for queues and endpoints, and test interception attempts. **Priority:** High **SI-7** **Requirement:** Implement integrity checks for data processed asynchronously to detect tampering or corruption. **Relevance:** Ensures the integrity of solutions and job payloads is verifiable during the asynchronous processing lifecycle. **Integration Tips:** Include checksums, signatures, or message authentication codes (MACs) on job payloads and verify them before processing. **Verification Method:** Inspect integrity verification code paths and attempt to submit tampered payloads to confirm detection. **Priority:** High ##### ISO 27001:2022 Controls **A.12.1.1** **Requirement:** Operational procedures should define and control background processing and message handling. **Relevance:** Mandates documented procedures around real-time job processing and polling operations. **Integration Tips:** Document job lifecycle, polling intervals, retry limits, and error handling; include operational runbooks for failures. **Verification Method:** Review operational procedures and perform runbook drills to validate behavior. **Priority:** Medium #### 6.2.12. REQ-012: Solution scoring, constraint violation analysis, and reporting ##### OWASP ASVS Controls **V11.2** **Requirement:** Log inputs, configuration, and outputs of automated decision algorithms to support auditing and explainability. **Relevance:** Directly applies to capturing evidence of scoring and constraint violations for review and dispute resolution. **Integration Tips:** Record solver inputs, scoring parameters, and output diffs; store logs securely with access controls for auditors. **Verification Method:** Check that algorithmic inputs/outputs are logged and can be correlated to user-visible reports. **Level:** L2 | **Priority:** High ##### NIST SP 800-53 Controls **PM-22** **Requirement:** Document and analyze how automated solutions are validated, scored, and how violations are reported. **Relevance:** Mandates documentation and governance around automated scoring which supports trustworthy reporting. **Integration Tips:** Maintain documentation of scoring methodology, test datasets, and validation results; define reporting formats and owners. **Verification Method:** Review documentation and validation artifacts and confirm reporting pipelines produce expected outputs. **Priority:** Medium **AU-12** **Requirement:** Generate audit records for security-relevant events including algorithm outputs and violations. **Relevance:** Ensures scoring and violation events are auditable and recorded for security/review purposes. **Integration Tips:** Define which scoring events are auditable, include identifiers correlating to inputs, and protect audit logs from tampering. **Verification Method:** Inspect audit logs for scoring events and test correlation between algorithm runs and generated logs. **Priority:** High ##### ISO 27001:2022 Controls **A.18.1.4** **Requirement:** Ensure compliance with regulatory requirements for automated processing and provide documentation for decisions. **Relevance:** Ensures scoring and reporting practices comply with privacy and regulatory requirements, especially if personal data influences scores. **Integration Tips:** Assess privacy impacts of scoring data, avoid unnecessary personal data in scoring logs, and provide explanations where decisions affect individuals. **Verification Method:** Review privacy assessments and validate that logs/reporting exclude unnecessary personal data or are appropriately protected. **Priority:** Medium #### 6.2.13. REQ-013: Shift preferences management (date-specific desired/undesired) and preference tracking ##### OWASP ASVS Controls **V1.5** **Requirement:** Design systems to minimize collection of personal data and protect user preferences and privacy. **Relevance:** Encourages design choices that limit privacy exposure for preference tracking features. **Integration Tips:** Collect only necessary preference attributes, provide user controls to view/edit/delete preferences, and protect data at rest. **Verification Method:** Inspect data schemas and UI controls for preference management and test deletion/exports to ensure removal. **Level:** L1 | **Priority:** High ##### NIST SP 800-53 Controls **PL-4** **Requirement:** Conduct privacy impact assessments for systems processing personal preferences. **Relevance:** Requires assessing privacy risks around storing and using user shift preferences. **Integration Tips:** Perform PIA to identify sensitive preferences (e.g., religious holidays) and apply minimization or extra protections as needed. **Verification Method:** Provide PIA documentation and evidence of mitigations implemented based on findings. **Priority:** Medium **AC-19** **Requirement:** Protect user attribute data including preferences with appropriate access controls. **Relevance:** Ensures preferences are only visible and editable by authorized entities to prevent privacy violations. **Integration Tips:** Apply attribute-level ACLs so preferences are scoped to the user or authorized managers; restrict export of sensitive preferences. **Verification Method:** Test access to preference records from different roles and verify unauthorized reads are blocked. **Priority:** Medium ##### ISO 27001:2022 Controls **A.18.1.4** **Requirement:** Ensure compliance with regulatory requirements for automated processing and provide documentation for decisions. **Relevance:** Preferences may be personal data; this control ensures processing complies with privacy requirements and is documented. **Integration Tips:** Limit retention of preference data, document how preferences are used in automated assignment, and expose preference reports for user review. **Verification Method:** Review privacy documentation and confirm preference handling is aligned with policy and retention rules. **Priority:** High #### 6.2.14. REQ-014: Unavailable dates and leave management (multiple leave types, date ranges, reasons) ##### OWASP ASVS Controls **V1.5** **Requirement:** Implement privacy-by-design for sensitive employee data, minimizing collection and ensuring secure storage. **Relevance:** Reinforces data minimization and secure handling for leave management modules. **Integration Tips:** Collect only required fields for leave processing, provide limited retention, and notify users about purpose and retention periods. **Verification Method:** Review UI/data collection forms and retention policies; verify secure storage controls in place. **Level:** L1 | **Priority:** Medium ##### NIST SP 800-53 Controls **PL-4** **Requirement:** Conduct privacy impact assessments when processing sensitive personal data such as health-related leave. **Relevance:** Requires evaluating privacy risks posed by collecting leave reasons and ranges and drives protective controls. **Integration Tips:** Conduct PIA focusing on special categories of data, implement minimization, and consider pseudonymization where possible. **Verification Method:** Provide PIA output and evidence of mitigations (pseudonymization, restricted access). **Priority:** High **MP-6** **Requirement:** Protect sensitive personal data at rest and in transit, and sanitize when exporting or transferring. **Relevance:** Applies to exporting or transferring leave records and ensuring sensitive reasons are sanitized or redacted. **Integration Tips:** Encrypt leave records at rest, apply field-level redaction for exports, and limit who can download leave data. **Verification Method:** Inspect encryption at rest, review export sanitization routines, and test role-based export restrictions. **Priority:** High ##### ISO 27001:2022 Controls **A.18.1.4** **Requirement:** Ensure compliance with regulatory requirements for automated processing and provide documentation for decisions. **Relevance:** Leave reasons may contain sensitive personal data (e.g., medical reasons); this control ensures privacy compliance for processing and storage. **Integration Tips:** Classify leave data sensitivity, apply stricter access controls for medical leave, and document legal bases for processing. **Verification Method:** Review data classification, access controls, and privacy handling for leave data. **Priority:** Critical #### 6.2.15. REQ-015: Skills management and skill-based matching for assignments ##### OWASP ASVS Controls **V4.2** **Requirement:** Implement and verify attribute-based authorization where access and matching logic relies on user attributes (skills). **Relevance:** Ensures matching logic based on skills is enforced and protected from manipulation. **Integration Tips:** Centralize attribute evaluation, prevent client-side overrides of attributes, and audit attribute changes. **Verification Method:** Attempt to alter skill attributes via API/UI and confirm authorization prevents incorrect matching. **Level:** L2 | **Priority:** High ##### NIST SP 800-53 Controls **AC-3 (5)** **Requirement:** Support attribute-based access control when access decisions depend on attributes such as skills. **Relevance:** Directly enables using skills as attributes for matching and access decisions in assignment processes. **Integration Tips:** Model skills as authoritative attributes, implement ABAC policies for matching, and ensure attribute sources are validated. **Verification Method:** Review ABAC policies and test that assignments respect skill attribute constraints. **Priority:** High **PM-11** **Requirement:** Ensure data used for decision making (e.g., skills) is accurate and maintained. **Relevance:** Ensures matching results are reliable by mandating data quality controls around skills datasets. **Integration Tips:** Implement periodic reviews and validation of skill records and provide user workflows to correct inaccuracies. **Verification Method:** Check data quality reports and validation procedures for skill records. **Priority:** Medium ##### ISO 27001:2022 Controls **A.9.2.2** **Requirement:** Provision access and attributes carefully to ensure accurate assignment of skills and privileges. **Relevance:** Requires controlled provisioning of skill attributes so matching is based on trusted data. **Integration Tips:** Use administrative workflows for adding/removing skills, record provenance, and require approvals for critical attributes. **Verification Method:** Review provisioning logs and sample attribute provenance to ensure correct assignment. **Priority:** Medium #### 6.2.16. REQ-016: Export of data (shifts, users, companies, skills, shift types, preferences, unavailable dates) in CSV/XLSX ##### OWASP ASVS Controls **V3.9** **Requirement:** Implement controls and authorization checks on data export features and ensure exported files do not leak sensitive data. **Relevance:** Specifies authorization and DLP measures for export functionality requested. **Integration Tips:** Require role-based export permissions, log all export operations, and throttle/alert on large exports to prevent exfiltration. **Verification Method:** Review export permission mappings, audit logs of exports, and perform attempts to export restricted datasets. **Level:** L2 | **Priority:** High ##### NIST SP 800-53 Controls **MP-6** **Requirement:** Protect sensitive data when exporting; sanitize or redact as required before transfer or export. **Relevance:** Directly applicable to preventing leakage of sensitive fields during data exports. **Integration Tips:** Implement export templates that redact PII or sensitive fields by role, and require explicit authorization for exports containing sensitive data. **Verification Method:** Test exports for redaction correctness across roles and ensure sanitized outputs do not expose sensitive data. **Priority:** Critical **AC-17** **Requirement:** Control remote access and transfers including file exports to prevent data exfiltration. **Relevance:** Applies to how exported files are transferred or downloaded to user endpoints and helps prevent exfiltration. **Integration Tips:** Restrict export downloads to secure channels, enforce endpoint device checks or warn about saving sensitive files, and record provenance. **Verification Method:** Test downloads over remote sessions and verify transfer controls are enforced. **Priority:** Medium ##### ISO 27001:2022 Controls **A.8.2.3** **Requirement:** Procedures for handling and transferring information assets including exports should be implemented. **Relevance:** Requires formal handling procedures for exported data assets to ensure protection and accountability. **Integration Tips:** Document export procedures, include approval steps for sensitive exports, and archive export copies securely if retained. **Verification Method:** Inspect documented procedures and sample approvals for export actions. **Priority:** Medium #### 6.2.17. REQ-017: External API integration with Timefold solver including payload generation and solution parsing ##### OWASP ASVS Controls **V13.1** **Requirement:** Securely integrate with third-party APIs using mutual authentication, input/output validation, and secure error handling. **Relevance:** Directly addresses securing the Timefold solver integration, verifying payloads, and safely parsing responses. **Integration Tips:** Apply strong authentication to the Timefold API, validate all solver responses against schema, and handle errors without exposing internal details. **Verification Method:** Inspect API authentication setup, review parsing code for schema validation, and execute malformed response tests. **Level:** L2 | **Priority:** Critical ##### NIST SP 800-53 Controls **SA-9** **Requirement:** Ensure that external interfaces are secured and that integration with external systems follows organizational policies. **Relevance:** Mandates governance for integrating external solvers and ensuring compliance with internal policies. **Integration Tips:** Document integration requirements, include security controls in the acquisition process, and require supplier security attestations. **Verification Method:** Review acquisition/integration documentation and evidence of supplier security posture checks. **Priority:** High **SC-8** **Requirement:** Protect the confidentiality and integrity of information during transmission to external services. **Relevance:** Ensures payloads and solutions exchanged with Timefold are protected from interception or tampering. **Integration Tips:** Use TLS, validate certificates, and consider message signing to ensure end-to-end integrity. **Verification Method:** Verify TLS config, perform MITM tests, and validate signature verification if implemented. **Priority:** High ##### ISO 27001:2022 Controls **A.14.2.5** **Requirement:** Security requirements for development and integration of interfaces should be defined and implemented. **Relevance:** Ensures development practices for payload generation and parsing include security requirements to avoid vulnerabilities. **Integration Tips:** Define interface contracts, include input/output validation, and perform secure code reviews and testing for parsing logic. **Verification Method:** Inspect interface contracts and review secure development artifacts and test results. **Priority:** Medium #### 6.2.18. REQ-018: Internationalization (multi-language UI and localized date/time formatting) ##### OWASP ASVS Controls **V9.7** **Requirement:** Properly handle Unicode, normalization, and encoding to prevent injection and XSS vulnerabilities across locales. **Relevance:** Directly relevant for multi-language UI and localized date/time handling to avoid injection vectors introduced by locale-specific encodings. **Integration Tips:** Normalize and canonicalize text inputs/outputs, apply proper encoding/escaping per output context, and validate locale-specific formats. **Verification Method:** Test inputs with various Unicode characters and locale-specific formats to detect XSS or parsing issues. **Level:** L2 | **Priority:** High **V9.1** **Requirement:** Validate and canonicalize input considering locale-specific encodings and formats. **Relevance:** Supports safe handling of user inputs in various languages and formats to prevent logic or parsing errors. **Integration Tips:** Implement validators that accept locale-specific formats but convert to canonical representations for processing and storage. **Verification Method:** Run locale-specific input validation tests and check canonicalization outputs. **Level:** L1 | **Priority:** Medium ##### NIST SP 800-53 Controls **SC-17** **Requirement:** Ensure localized data formats and time/date handling do not weaken security mechanisms and are consistently handled. **Relevance:** Ensures localized formatting does not break security checks like signature verification or token expiry calculations. **Integration Tips:** Use locale-aware libraries for date/time parsing, store timestamps in canonical format (UTC) internally, and format only at presentation layer. **Verification Method:** Review date/time handling code and test across locales for consistent behavior of security-sensitive features. **Priority:** Medium ##### ISO 27001:2022 Controls **A.14.2.5** **Requirement:** Include security requirements for localized applications and data handling in development. **Relevance:** Mandates inclusion of localization security needs in development practices for internationalized UI. **Integration Tips:** Include localization security checks in SDLC, perform code reviews focused on encoding/formatting, and update test suites for locales. **Verification Method:** Inspect development checklists and localized test cases for security considerations. **Priority:** Low #### 6.2.19. REQ-019: User interface features: responsive navigation, tables with pagination/sorting/filtering, calendar views, alerts/notifications, breadcrumbs ##### OWASP ASVS Controls **V9.2** **Requirement:** Encode output and validate input to prevent XSS, especially in tables, filters, and dynamic navigation elements. **Relevance:** Directly applies to UI elements which render user-controlled content and are susceptible to XSS and injection attacks. **Integration Tips:** Escape/encode user data in the proper HTML/JS context, apply CSP headers, and avoid dangerous innerHTML patterns. **Verification Method:** Perform XSS testing across UI components including pagination and dynamic filters. **Level:** L1 | **Priority:** Critical **V5.4** **Requirement:** Implement CSRF protections for state-changing UI actions like shift creation or accept/reject. **Relevance:** Protects UI actions (calendar interactions, form submissions) from CSRF attacks that could create/change shifts. **Integration Tips:** Use anti-CSRF tokens for state-modifying requests and validate origin/referrer where appropriate. **Verification Method:** Perform CSRF attack simulations against state-changing endpoints and verify tokens are required and validated. **Level:** L1 | **Priority:** High ##### NIST SP 800-53 Controls **SI-10** **Requirement:** Validate input and handle errors gracefully to avoid exposing sensitive information in UI components. **Relevance:** Encourages sanitizing/filtering user inputs used for sorting/pagination and ensuring error messages do not leak internals. **Integration Tips:** Validate query parameters for pagination/sorting on server-side and sanitize user-visible error messages. **Verification Method:** Review server-side validation for UI query parameters and inspect error messages for sensitive info. **Priority:** High ##### ISO 27001:2022 Controls **A.12.2.1** **Requirement:** Apply secure development and application-level controls to mitigate common application threats. **Relevance:** Provides general secure development guidance for UI features to reduce vulnerabilities like XSS and CSRF. **Integration Tips:** Adopt secure UI development practices, include security tests in CI, and ensure third-party UI libs are vetted. **Verification Method:** Check secure development artifacts, dependency scans, and UI security test results. **Priority:** Medium #### 6.2.20. REQ-020: Audit logging, legal documents availability (Privacy Policy, Terms of Service), and consent tracking ##### OWASP ASVS Controls **V10.3** **Requirement:** Log legal acknowledgements and consent events and ensure integrity of such records. **Relevance:** Specifies logging of legal events and integrity protections which are key to proving consent. **Integration Tips:** Use tamper-evident storage for consent records or append-only logs and ensure access controls over consent records. **Verification Method:** Attempt to alter consent records in test environment and verify tamper detection and access controls. **Level:** L1 | **Priority:** High ##### NIST SP 800-53 Controls **AU-2** **Requirement:** Determine and log auditable events including user consent and policy acceptance. **Relevance:** Directly maps to logging consent events and availability of legal document acceptance records. **Integration Tips:** Log consent events with timestamp, user ID, document version, and store immutably; ensure logs are searchable for audit. **Verification Method:** Review consent logs, verify they contain required fields, and test retrieval for audit scenarios. **Priority:** Critical **PL-2** **Requirement:** Establish policies for handling legal documents and consent records. **Relevance:** Requires formal policies governing how legal documents and consent are managed within the system. **Integration Tips:** Develop policy that defines retention, access, and usage of consent records and implement controls accordingly. **Verification Method:** Review policy documentation and evidence of policy enforcement in system practices. **Priority:** Medium ##### ISO 27001:2022 Controls **A.18.1.4** **Requirement:** Ensure compliance with privacy requirements and record legal consents and policy acknowledgments. **Relevance:** Establishes requirement to track legal consents and ensure privacy compliance for policy-driven behaviors. **Integration Tips:** Retain versions of legal documents, capture consent metadata, and provide user-facing access to documents and consent history. **Verification Method:** Verify retention of document versions and sample consent records match user acknowledgments. **Priority:** High ### 6.3. Cross-Functional Security Controls The following controls apply globally across all system components: **Logging and Audit Trails** *Description:* Centralized, tamper-resistant logging of security-relevant events including authentication, authorization changes, exports, consent events, solver interactions, and algorithmic outputs. *Applies to:* All requirements (global), Audit logging features, Automated assignment and solver integration, Data export and profile changes *Implementation Guidance:* Implement an append-only or integrity-protected logging system (WORM or signed logs), centralize logs with access controls, and define retention and review processes. Ensure logs capture actor, timestamp, action, target resource and before/after states where applicable. **Encryption in Transit and at Rest** *Description:* Protect sensitive data (credentials, PII, solver payloads, exported files) with strong encryption during transit and at rest. *Applies to:* Authentication flows, External API integrations, Asynchronous job payloads, Exported files and sensitive data stores *Implementation Guidance:* Use TLS with current best-practice cipher suites for all external and internal communication; encrypt data at rest with managed keys and apply field-level encryption for highly sensitive fields. Rotate keys and manage access to encryption keys via KMS with strict IAM controls. **Input Validation and Output Encoding** *Description:* Canonicalize, validate and sanitize inputs; encode outputs according to their context to prevent injection (XSS, SQLi) and logic bypass. *Applies to:* UI components (tables, filters, calendar), Shift/skill/leave creation and updates, API payloads and external solver responses *Implementation Guidance:* Implement server-side canonicalization and validation for all inputs, apply context-aware encoding on outputs, and use schema validation for APIs. Include locale-aware validation for internationalized inputs and test with Unicode edge-cases. **Access Control and Authorization** *Description:* Centralized enforcement of role-based and attribute-based access controls, with least privilege and tenant scoping. *Applies to:* RBAC and user status, Company CRUD/multi-tenant scoping, Profile and assignment management, Export and administrative functions *Implementation Guidance:* Use a centralized authorization service or middleware enforcing RBAC/ABAC checks at every API entrypoint, include tenant_id in access decisions, and implement policy management and review processes to keep permissions up-to-date. **Privacy and Data Minimization** *Description:* Assess and minimize personal data collection (preferences, leave reasons) and protect special categories of data with additional safeguards. *Applies to:* Preferences and leave management, Exports and reporting, Algorithmic scoring and solver inputs/outputs *Implementation Guidance:* Conduct PIAs for sensitive data, apply pseudonymization or redaction for exports, limit retention periods, and restrict access to need-to-know personnel. Record legal basis and user consent where required. ### 6.4. Requirements Traceability Overview This section demonstrates complete traceability from high-level requirements through threats to security controls and verification methods. **Coverage Summary:** Traceability matrix contains 25 requirements. 25 requirements (100.0%) linked to threats. 19 requirements (76.0%) mapped to security controls (OWASP ASVS, NIST SP 800-53, ISO 27001). Coverage: Partial. #### Sample Traceability Mappings The following table shows traceability for high-priority requirements: | Req ID | Requirement | Threats | Security Controls | Standards | Priority | Verification | |--------|-------------|---------|-------------------|-----------|----------|-------------| | REQ-001 | User registration with email verificatio... | 10 threats | 4 controls | ISO27001, NIST, OWASP | Critical | Review implementation of email verification flow, inspect token properties (single-use, expiry), and test account behavior before and after verification. | | REQ-002 | Authentication supporting credentials-ba... | 5 threats | 4 controls | ISO27001, NIST, OWASP | Critical | Examine policies for federated identity, test SSO flows for proper authentication, and verify credential handling meets organizational standards. | | REQ-003 | Password reset and account recovery flow... | 10 threats | 4 controls | ISO27001, NIST, OWASP | Critical | Review recovery policies, validate multi-step verification for sensitive accounts, and inspect logs of recovery events. | | REQ-004 | Role-based access control (ADMIN, MANAGE... | 10 threats | 4 controls | ISO27001, NIST, OWASP | Critical | Audit automation integrations, simulate HR-driven status changes, and verify system enforces new statuses immediately. | | REQ-006 | Admin-only company CRUD and multi-tenant... | 10 threats | 4 controls | ISO27001, NIST, OWASP | Critical | Review data access code, run multi-tenant isolation tests (attempt cross-tenant reads/writes), and inspect database policies. | | REQ-008 | Manual shift assignment: create, update,... | 10 threats | 4 controls | ISO27001, NIST, OWASP | Critical | Inspect logs for the required events, retention configuration, and access controls around logs. | | REQ-011 | Automated shift assignment via external ... | 10 threats | 4 controls | ISO27001, NIST, OWASP | Critical | Inspect TLS configuration, perform MITM tests, and verify payload signatures if implemented. | | REQ-012 | Asynchronous job processing for optimiza... | 4 threats | 4 controls | ISO27001, NIST, OWASP | Critical | Inspect integrity verification code paths and attempt to submit tampered payloads to confirm detection. | | REQ-016 | Unavailable dates and leave management (... | 8 threats | 4 controls | ISO27001, NIST, OWASP | Critical | Review data classification, access controls, and privacy handling for leave data. | | REQ-018 | Data export in CSV and XLSX for entities... | 10 threats | 4 controls | ISO27001, NIST, OWASP | Critical | Review data classification, access controls, and privacy handling for leave data. | *Showing 10 of 25 requirements. See Appendix D for complete traceability matrix.* #### Traceability Statistics - **Total Requirements Tracked:** 25 - **Requirements Linked to Threats:** 25 (100.0%) - **Requirements Mapped to Controls:** 19 (76.0%) - **Average Controls per Requirement:** 3.0 - **Control Distribution by Standard:** - NIST SP 800-53: 33 controls - OWASP ASVS: 24 controls - ISO 27001: 19 controls - **Verification Coverage:** 100% (all requirements have verification methods) --- ## 7. AI/ML Security Requirements This section addresses security requirements specific to artificial intelligence and machine learning components within the system. AI/ML systems introduce unique security challenges including prompt injection attacks, data poisoning, model theft, adversarial inputs, and bias vulnerabilities. This analysis identifies AI/ML components, assesses their security risks, and prescribes specialized controls to protect both the AI systems themselves and the data they process. ### 7.1. AI/ML Components Detected This section identifies all AI/ML components within the system that require specialized security controls. 1. **Automated Shift Assignment**: Utilizes an external optimization solver (Timefold) to automate shift assignment based on constraints and user preferences. 2. **Optimization Scoring and Reporting**: Analyzes and scores generated shift assignments based on hard and soft constraints, providing feedback on constraint violations. ### 7.2. AI/ML Threat Model | Component | Identified Threats | |----------------------------------|-----------------------------------------------------| | Automated Shift Assignment | - Prompt injection | | | - Data leakage (sensitive user information in prompts) | | | - Model poisoning (manipulating the optimization algorithm) | | | - Adversarial inputs (crafting inputs to yield biased outputs) | | Optimization Scoring and Reporting| - Data leakage (exposing sensitive data in scoring feedback) | | | - Model inversion attacks (extracting training data from model output) | ### 7.3. AI/ML Security Controls #### Automated Shift Assignment **Prompt Injection Prevention**: Implement strict input validation to ensure that inputs to the external solver do not contain malicious commands or unexpected data formats. **Input Validation for AI Inputs**: Validate all user inputs against a predefined schema to prevent injection attacks. **Output Filtering and Sanitization**: Sanitize outputs from the optimization solver to ensure that no sensitive data is leaked in the response. **Data Leakage Prevention**: Use encryption to protect sensitive user data that might be included in prompts sent to the external solver. **Model Access Controls**: Restrict access to the optimization API to authorized users and services only. **Rate Limiting and Abuse Prevention**: Implement rate limiting on requests to the external solver to prevent abuse and denial-of-service attacks. #### Optimization Scoring and Reporting **Monitoring for Adversarial Inputs**: Set up monitoring to detect unusual patterns in scoring requests that might indicate adversarial behavior. **Model Versioning and Rollback Capabilities**: Maintain version control of the optimization model to allow quick rollbacks to previous safe versions if vulnerabilities are detected. **Supply Chain Security for Models**: Vet and verify the security posture of third-party optimization solver providers. **Bias and Fairness Considerations**: Regularly audit the scoring algorithm for fairness and bias, ensuring that outputs do not favor any group over another. ### 7.4. Integration with Existing Security Controls AI/ML security controls should be integrated with existing security practices such as role-based access control, secure API management, and regular security audits. The automated shift assignment and scoring components should be monitored as part of the overall application security monitoring strategy, ensuring that standard practices for logging, incident response, and data protection extend to AI/ML functionalities. ### 7.5. AI/ML Monitoring Requirements | Monitoring Area | Description | |----------------------------------|-----------------------------------------------------| | Input Validation Logs | Log all inputs sent to the external optimization solver for auditing and anomaly detection. | | Output Sanitization Logs | Log outputs received from the optimization solver, ensuring no sensitive information is present. | | Access Control Monitoring | Monitor access to the optimization API to detect unauthorized access attempts. | | Anomaly Detection for Scoring | Implement anomaly detection on scoring outputs to identify potential adversarial attacks. | | Audit Logs | Maintain detailed audit logs for all AI/ML interactions to support investigations and compliance. | --- ## 8. Compliance Requirements This section identifies regulatory and legal compliance obligations applicable to the system based on data types, geographic scope, industry sector, and business operations. Compliance requirements drive specific security controls, data handling procedures, audit capabilities, and privacy protections. Non-compliance can result in significant legal penalties, reputational damage, and business disruption. This analysis maps applicable regulations to specific security requirements and operational procedures. ### 8.1. Applicable Regulations In analyzing the requirements for the Shift Management System, several regulations were identified based on the nature of the data being processed, the geographic scope of the application, its industry sector, and the business operations involved. The application handles personal information of employees and may also interact with various compliance-sensitive data types, such as health information and payment data. Each regulation identified imposes specific compliance requirements that directly impact the security controls, data handling procedures, and operational processes necessary to ensure legal compliance. Below is a table summarizing the relevant regulations. | Regulation | Applicability Reason | |------------|----------------------| | GDPR | Applies because the system processes personal data of EU residents. | | CCPA | Applies due to the handling of personal data of California residents. | | HIPAA | May apply if the application handles any health-related information of employees. | | PCI-DSS | Relevant if any payment card data is processed for employee reimbursements. | | SOX | Applies to financial data management and auditing requirements for operational transparency. | | GLBA | Applies if the application involves financial information related to employees or companies. | | COPPA | Relevant if the application collects data from users under the age of 13. | | Data Residency Laws | Applies based on the geographic location of the data storage and processing. | ### 8.2. Compliance Controls by Regulation #### GDPR - Implement data encryption for personal data. - Enable user consent mechanisms for data processing. - Establish data access controls and role-based access management. - Implement data minimization principles to limit data collection to only what is necessary. #### CCPA - Provide clear privacy notices to users about data collection and usage. - Implement mechanisms for users to exercise their rights to access, delete, or opt-out of the sale of personal data. - Ensure data security measures are in place to protect personal information. #### HIPAA - Establish safeguards for protected health information (PHI). - Implement access controls to limit PHI access to authorized personnel only. - Conduct regular risk assessments and audits related to PHI handling. #### PCI-DSS - Use strong encryption methods for storing and transmitting payment card data. - Maintain a secure network by implementing firewalls and anti-virus software. - Regularly monitor and test networks to identify vulnerabilities. #### SOX - Implement internal controls for financial reporting and data integrity. - Maintain audit logs for all financial transactions related to employee payments and reimbursements. - Establish regular audits for compliance verification. #### GLBA - Develop policies for the protection of nonpublic personal information (NPI). - Implement measures to ensure the confidentiality and security of financial data. - Provide clear privacy notices regarding the sharing of financial information. #### COPPA - Implement parental consent mechanisms for users under 13. - Ensure data collection practices are transparent for minor users. #### Data Residency Laws - Store and process data in compliance with the local laws of the geographic regions where users reside. - Implement data transfer mechanisms that comply with cross-border data regulations. ### 8.3. Data Subject Rights | Right | Description | |---------------------|--------------------------------------------------| | Right to Access | Users can request access to their personal data. | | Right to Rectification | Users can request correction of inaccurate data. | | Right to Erasure | Users can request deletion of their personal data. | | Right to Object | Users can object to the processing of their data. | | Right to Data Portability | Users can request their data in a portable format. | ### 8.4. Privacy Requirements **Consent:** Users must provide explicit consent for their personal data to be collected and processed. **Privacy Notice:** Clear privacy policies must be displayed, outlining data collection, usage, and rights of users. ### 8.5. Audit and Monitoring Requirements **Logging:** Maintain audit logs of user access and data modifications to ensure traceability. **Monitoring:** Regularly monitor data access and changes to ensure compliance with regulations. ### 8.6. Data Handling Rules **Retention:** Personal data should be retained only as long as necessary for its intended purpose and must be securely deleted afterward. **Deletion:** Implement procedures for the secure deletion of personal data upon request or once data retention periods have expired. ### 8.7. Compliance Risk Assessment In assessing the compliance risks associated with the Shift Management System, various key compliance risks have been identified that could impact the organization if not properly managed. These risks can lead to legal penalties, loss of user trust, and reputational damage. **Key Compliance Risks:** - Failure to obtain proper consent for personal data processing could result in GDPR and CCPA violations. - Inadequate protection of health information could lead to HIPAA breaches and associated penalties. - Lack of secure handling of payment data could result in PCI-DSS compliance failures, leading to significant fines. - Insufficient auditing and controls over financial data could violate SOX and GLBA requirements, resulting in legal repercussions. --- ## 9. Security Architecture Recommendations This section provides comprehensive security architecture guidance that integrates security controls into the system's technical design. Security architecture defines how security principles, controls, and patterns are applied across system components to create a cohesive, defense-in-depth security posture. The recommendations address architectural principles, component-level controls, data protection strategies, and third-party integration security to ensure security is built into the system design. ### 9.1. Architectural Security Principles Architectural security principles provide the foundational philosophy guiding all security design decisions. These principles ensure a consistent security posture across all system components and guide selection and implementation of controls so the Shift Management System remains resilient, auditable, and privacy-preserving. - **Zero Trust Architecture principles:** Never trust, always verify — every request, user, and service must be authenticated and authorized regardless of network location; reduces risk from compromised internal networks and enforces fine-grained controls. - **Defense in Depth:** Deploy multiple layers (network, host, application, data) so that failure of one control does not result in a total compromise; ensures redundancy and detection opportunities at each layer. - **Principle of Least Privilege:** Grant users, services, and processes only the minimum permissions required to perform tasks; reduces blast radius of compromised accounts or services. - **Secure by Default / Secure by Design:** Systems are secure out-of-the-box with safe defaults (secure configs, disabled debug endpoints), and security is incorporated throughout the SDLC and architecture. - **Separation of Duties:** Split responsibilities across roles and systems (e.g., admin vs. operator vs. auditor) to limit fraud and mistakes and to provide checks-and-balances for sensitive actions like accepting solver results or exporting data. - **Fail Secure:** In failure scenarios default to safe-deny behaviors (e.g., reject unverified solver responses, deny access on auth service failures) to prevent unauthorized operations. - **Complete Mediation:** Every access to a resource is checked against up-to-date authorization policy (no caching of authorization decisions without revalidation for sensitive operations). - **Minimize Attack Surface:** Reduce exposed interfaces and services; disable unnecessary features, and limit public endpoints to those required for the SPA/API gateway. - **Auditability and Accountability:** Design to capture immutable audit trails for security-relevant events (authentication, acceptance of auto-assignment, exports, leave records) with sufficient context for investigations and compliance. - **Data Minimization and Privacy-by-Design:** Collect and store the minimum personal data necessary; treat leave and preference data as potentially sensitive and apply stronger protections and PIAs. - **Cryptographic Best-Practices:** Use modern, vetted algorithms, centralized key management, short-lived credentials where possible, and hardware-backed keys (HSM/KMS) for critical secrets. - **Resilience and Observability:** Instrument system health, security telemetry, and business events to detect misuse and faults quickly and support IR and SLA goals. --- ### 9.2. Component-Level Security Controls #### Frontend User Interface **Required Controls:** - Enforce output encoding and input validation on all user-supplied content. - Implement Content Security Policy (CSP), X-Frame-Options, X-Content-Type-Options, and Referrer-Policy headers. - Use OAuth2/OpenID Connect Authorization Code flow with PKCE for Google sign-in. - Use secure, HttpOnly, SameSite=strict cookies or short-lived access tokens stored in secure browser cookie with CSRF protections. - Implement CSRF protection for all state-changing requests. - Validate and canonicalize locale-specific inputs to defend against injection/XSS through localization. - Prevent sensitive data in localStorage; avoid persisting tokens to client side beyond short-lived needs. - Implement client-side rate-limiting UI protections (to reduce accidental high frequency) and enforce rate limits server-side. - Protect file downloads (exports) with signed, time-limited pre-signed URLs and role checks. **Recommended Patterns:** - Serve SPA via CDN with SRI (subresource integrity) and strict TLS enforcement. - WAF in front of static assets to block known web attacks and bot abuse. - Use same-origin policies and secure cookie settings; prefer cookie-based session with anti-CSRF tokens for forms. - Use client-side feature flags with server-side guard for risky features (auto-accept of solver results disabled by default for lower roles). - Implement localization libraries that sanitize and canonicalize input/output. #### Edge Layer (CDN & API Gateway) **Required Controls:** - TLS termination with TLS1.3 preferred and strong cipher suite; enforce HSTS. - Web Application Firewall (managed rules + custom rules) with OWASP top-10 protections enabled. - DDoS protection and rate limiting per IP and per API key/tenant. - API authentication and token validation at gateway (JWT stateless validation and introspection for opaque tokens). - Geo/IP-based access controls and egress/ingress filtering for management endpoints. - Request size limits and schema validation at gateway for large solver/payload submissions. - Centralized access logging (structured logs), WAF alerts, and request tracing headers (correlation id). **Recommended Patterns:** - API Gateway with OAuth2 token validation and JWT introspection and per-tenant quota enforcement. - Use a layered edge model: CDN for static assets + WAF + API Gateway for dynamic endpoints. - mTLS between API gateway and backend application services for internal trust. - Gateway-level response caching for safe-read endpoints and circuit-breaker patterns for external service unavailability. #### Application Services **Required Controls:** - Centralized Authentication and Authorization service (AuthN/AuthZ) with RBAC + ABAC support; evaluate Open Policy Agent (OPA) for policy enforcement. - Strong password handling: Argon2id (or bcrypt with modern params) with per-user salts; enforce password policy and rate-limit login and reset attempts. - Multi-factor authentication (MFA) option for admins and managers. - Role and tenant scoping enforced server-side on every API (complete mediation). - Input validation and canonicalization for business objects (shifts, times, preference data) and solver payloads. - Audit events for all security-relevant operations (user CRUD, exports, accept/reject solver solution, status changes) with before/after state. - Service-to-service authentication using short-lived tokens and mTLS; secrets stored in KMS/secret manager and rotated automatically. - Background job authorization and validation for queued tasks and solver orchestration; jobs signed and verified. - Strict schema validation and whitelisting for Timefold solver responses; do not auto-commit without operator validation. - Protect endpoints with rate limiting, anomaly detection (excessive changes), and IP reputation checks. **Recommended Patterns:** - Microservices architecture with an API Gateway fronting services and a centralized auth service. - Policy engine (OPA) or centralized IAM for RBAC/ABAC decisions integrated into middleware. - Service mesh (e.g., Istio) for mTLS, traffic control, observability, and failure isolation between services. - Use message queue (SQS/RabbitMQ) with encrypted payloads and ACLs for async jobs. - Use signed job payloads and integrity checks (HMAC/JWS) for async job lifecycle. #### Data Layer **Required Controls:** - Row-level tenant isolation (tenant_id predicate enforced at data layer) or per-tenant schema architecture to prevent cross-tenant access. - Database encryption at rest (TDE) and field-level/envelope encryption for highly sensitive fields (leave reasons, medical data). - Strong DB authentication with IAM/managed identities; no long-lived DB credentials in code. - Backups encrypted, access-controlled, and tested for restoration; backup retention policy aligned to compliance. - Database activity monitoring and audit logs capturing DML operations for sensitive tables. - Prepared statements / ORM parameterization and input validation to prevent SQL injection. - Redis/session cache encrypted in transit and at rest; strict ACLs for caches. **Recommended Patterns:** - Managed RDBMS with Transparent Data Encryption + column-level encryption for PII. - Use Row-Level Security (RLS) or mandatory tenant filter middleware to enforce tenant scoping. - VPC-only database access; private subnets and restricted admin bastion with MFA. - Object storage with server-side encryption + customer-managed keys for exported artifacts and solver artifacts. #### External Services **Required Controls:** - Explicit trust model and contractual SLAs/security requirements for each supplier (Google OAuth, Email provider, Timefold). - Use secure connection models (OAuth2/OpenID Connect with ID token validation; mTLS for solver where supported). - Secrets for external APIs stored and rotated via KMS/secret manager; restrict scopes to least privilege. - End-to-end logging and correlation for requests/responses to/from external services; validate all external responses. - Circuit breakers and retry/backoff policies for external service failures. **Recommended Patterns:** - Private connectivity (VPC endpoints, PrivateLink) to external providers where supported to avoid public internet egress. - Use signed payloads (JWS) or message-level integrity checks for solver payloads/results. - Centralized integration gateway for third-party calls with per-integration policies (rate limit, auth, monitoring). --- ### 9.3. Data Protection Strategy **Data Classification:** Public, Internal, Confidential, Restricted - Public: Non-sensitive static content (marketing copy, CSS, JavaScript) that can be publicly accessible. - Internal: Operational metadata and logs that are not user-identifiable (system metrics, anonymized analytics). - Confidential: User profile data, job metadata, shift assignments (excluding sensitive leave reasons), company records, skills, shift types. - Restricted: Sensitive personal data (leave reasons containing health info, explicit PII like national identifiers), solver payloads that include PII tied to optimization decisions, audit trails containing sensitive context, and exports including PII. **Encryption Requirements:** - Data in transit: TLS 1.3 preferred; support TLS 1.2 with strong ciphers (ECDHE with AES-GCM or ChaCha20-Poly1305). Enforce HSTS and disable insecure ciphers and legacy protocols. - Data at rest: - Use AES-256-GCM for symmetric encryption of databases, object storage, and backups. - Use envelope encryption with customer-managed keys (CMKs) stored/managed in KMS/HSM. - Field-level encryption for Restricted fields using AES-256-GCM with keys derived via KMS and, where necessary, additional application-level encryption. - Keys and signatures: - Use RSA-3072 or ECDSA P-256/P-384 for asymmetric needs; prefer ECC (P-256 or secp384r1) for signatures (e.g., JWS ES256/ES384). - Password hashing: Argon2id with tuned parameters (memory, iterations) appropriate to platform; store only salted hashes. - HMAC: Use HMAC-SHA256 or better for integrity checks. - Solver interactions: - Use mTLS where supported, or OAuth2 Client Credentials with short-lived tokens. - Consider payload signing (JWS) so solver responses can be verified against known public keys. **Retention Policies:** - User account data: Retain active account data while account status is ACTIVE; upon deletion/requested erasure, remove or anonymize within 30 days unless legal hold applies. - Preferences and unavailable dates: Retain for business needs; default retention 2 years unless user requests deletion or longer retention required by employer policies. - Solver artifacts and generated assignments: Keep drafts and solver payloads for 90 days by default for audit/traceability; mark older artifacts for purge or archive to long-term cold storage if needed for compliance (7 years if required by contracts). - Export files: Keep pre-signed export artifacts available for download for 7 days then auto-delete. If a copy is retained server-side (for audit), store in encrypted object storage with limited retention (90 days) unless flagged for longer retention with approval. - Audit logs: Maintain security and audit logs for at least 1 year online and archive for up to 7 years depending on regulatory requirements. - Backups: Encrypted backups retained per organizational recovery objectives (e.g., 30-90 days rotation, archived snapshots per legal requirements). **Handling Procedures:** - Access: - Enforce role-based and attribute-based access controls; require approval/workflow for exports containing Confidential/Restricted data. - Sensitive fields (Restricted) accessible only to authorized roles and logged with justification. - Transmission: - All external communications use TLS; prefer private connectivity to external providers. - For solver payloads, enforce payload signing or HMAC and validate integrity on receipt. - Storage: - Apply least-privilege IAM for data stores and KMS; restrict access to key usage via IAM policies. - Implement monitoring and alerting for anomalous accesses (large exports, bulk reads). - Deletion: - Implement soft-delete with secure permanent deletion policy: soft-delete retention for recoverability (e.g., 30 days) then cryptographic shredding (delete keys and data) or secure wipe per storage provider capabilities. - For GDPR/CCPA erasure requests: remove personal identifiers and replace with pseudonymous token; purge all backups subject to legal hold exceptions and document actions. - Backups and replication: - Ensure backups are encrypted and keys rotated; test restore processes. - Export sanitization: - Redact or pseudonymize sensitive fields in exports by default; create role-based templates for sensitive exports requiring approval and additional logging. - Developer and CI/CD: - Secrets never in source control. Use ephemeral credentials in CI/CD, secrets manager integration, SCA checks on dependencies, and signing of build artifacts. --- ### 9.4. Third-Party Integration Security **Google OAuth (OpenID Connect)** *Security Requirements:* - Use OAuth2/OpenID Connect Authorization Code flow with PKCE. - Validate ID tokens server-side (aud, iss, exp, nonce). - Restrict redirect URIs to exact values and register app secrets in secrets manager. - Scopes limited to minimum required identity attributes. *Risk Assessment:* High — identity provider compromise or misconfiguration can allow account takeovers or impersonation. Incorrect token validation can yield privilege escalation. *Recommended Controls:* - Use well-vetted OIDC libraries and perform server-side token validation. - Enforce client secrets and redirect URI restrictions; rotate client secrets periodically. - Map federated identities to internal accounts with tenant-binding checks and do not grant elevated roles without additional verification (e.g., email domain checks and admin approval). - Monitor OAuth events, anomalous sign-ins, and adopt adaptive risk-based controls (MFA for suspicious sessions). **Email Delivery Provider (e.g., SendGrid, SES, Mailgun)** *Security Requirements:* - Use API keys stored in secrets manager with least privilege. - Enforce TLS for SMTP/API endpoints. - Sign transactional emails via DKIM and SPF configuration for domain. *Risk Assessment:* Medium — email is used for verification and password resets; compromise or interception can enable account takeover. *Recommended Controls:* - Rotate API keys and restrict inbound/outbound domains. - Rate-limit email sends and monitor for abnormal volumes (spam detection). - Use signed verification links (single-use, short-lived tokens) and monitor bounce/failure rates. **Timefold Optimization Solver** *Security Requirements:* - mTLS or OAuth2 client credentials for mutual authentication. - Schema validation for solver payloads and responses. - Signed payloads or HMAC to establish integrity/trust between system and solver. *Risk Assessment:* High — solver results directly affect schedule and may contain PII; corrupted or malicious responses could create unsafe assignments or data leakage. *Recommended Controls:* - Use mTLS or mutually authenticated TLS endpoints; restrict endpoints and IPs via allowlists. - Sign requests (JWS) and require signed responses; validate signatures before allowing preview or commit. - Sandbox parsing and extensive schema validation; treat solver as untrusted until validated. - Keep solver payloads and responses encrypted in transit and at rest; log inputs/outputs for audit with redaction for sensitive fields. **CDN & WAF Provider** *Security Requirements:* - TLS termination with HTTP security headers support. - Access to management console restricted with MFA and RBAC. - Support for custom WAF rules and real-time logging. *Risk Assessment:* High — misconfiguration or provider compromise may expose traffic or bypass protections. *Recommended Controls:* - Use least-privileged API keys, restrict management IPs, and enforce MFA for admin management. - Deploy custom WAF rulesets for app patterns and tune with observable logs. - Integrate CDN logs into SOC pipeline for monitoring and incident response. **Object Storage (S3-compatible)** *Security Requirements:* - Server-side encryption with CMKs and enforce TLS for all transfers. - Bucket policies limiting public access and enforcing VPC endpoints where possible. *Risk Assessment:* High — exported artifacts and solver artifacts stored here may contain PII; misconfigured buckets lead to data exposure. *Recommended Controls:* - Block public access by default; use pre-signed URLs for downloads and short TTLs. - Enforce bucket-level logging and object lock/WORM for audit archives as appropriate. - Use lifecycle policies to auto-delete artifacts per retention rules. **Queueing/Background Job System (SQS, RabbitMQ)** *Security Requirements:* - TLS for broker connections; access control lists for producers/consumers. - Message-level encryption and integrity checks for solver payloads. *Risk Assessment:* Medium — job tampering or unauthorized enqueuing could trigger unauthorized operations or leak data. *Recommended Controls:* - Enforce authentication for producers/consumers and validate job payloads before processing. - Use signed job tokens and schema validation; audit enqueue/dequeue events. **Monitoring & Logging (Datadog/CloudWatch or SIEM)** *Security Requirements:* - Secure ingestion endpoints, role-based access to dashboards, and encrypted storage for logs. - Integration must not leak PII to public dashboards. *Risk Assessment:* Medium — logs contain sensitive info; exposure could expose PII or secrets. *Recommended Controls:* - Redact or mask PII in logs prior to ingestion; use separate role-based dashboards for sensitive telemetry. - Protect alerting channels with MFA and integrate monitoring alerts into incident response workflows. **HR/External Identity or Directory Sync (if integrated later)** *Security Requirements:* - Use SCIM or secure API with OAuth2; consent and least-privilege provisioning. - Implement reconciliation and mutual authentication. *Risk Assessment:* High — provisioning errors can result in privilege escalation or orphaned accounts. *Recommended Controls:* - Keep provisioning scope minimal, audit provisioning events, and provide manual approval steps for sensitive role assignments. --- Overall Integration and Orchestration Notes - All integrations must be captured in a supplier security profile (SLA, incident response expectations, audit rights). - Use encryption-in-flight and at-rest consistently; prefer private network connectivity (VPC, PrivateLink) where supported. - Log correlation IDs end-to-end for tracing solver jobs from submission through solution commit or rejection. - Implement automated smoke tests and contract tests for integrations; include negative tests (malformed payloads, replayed responses). - Maintain a supplier risk register and conduct periodic security reviews and penetration tests involving third-parties. --- Appendix — Operational and Governance Recommendations (concise) - CI/CD: Sign build artifacts, enforce SCA and dependency scanning, require PR code reviews, and gate deployments with security checks. - Secrets Management: Centralize secrets in KMS/secret manager with automated rotation and narrow IAM roles. - Incident Response: Playbooks for compromised solver responses, mass export detection, or data exfiltration; tabletop exercises twice yearly. - Privacy & Compliance: Conduct PIAs for preference and leave modules; document legal basis for data processing and support DSAR/erasure workflows. - Testing: Include fuzzing for solver parser, localization-based XSS test cases, RBAC pentesting, and multi-tenant isolation testing. - Personnel: Least-privilege admin accounts, break glass procedures with audit and short TTL, enforce MFA, and periodic access reviews. - Operational Monitoring: SIEM rules for unusual export volumes, mass changes in shifts, repeated failed auth attempts, and anomalous solver acceptances. This document, when applied across engineering, platform, and security ops, provides a coherent, defense-in-depth architecture that enables secure handling of sensitive employee scheduling data, trustworthy integration with external solvers, and auditable operations suitable for a multi-tenant cloud-hosted Shift Management System. --- ## 10. Implementation Roadmap This section provides a prioritized, phased approach for implementing the security controls identified throughout this analysis. The roadmap organizes security measures into logical phases based on risk, dependencies, and resource availability, ensuring critical security gaps are addressed first while building a foundation for comprehensive security coverage. ### 10.1. Prioritization Framework Prioritization of security controls is crucial to effectively mitigate risks while aligning with compliance requirements and resource constraints. This approach ensures that the most critical vulnerabilities and compliance obligations are addressed promptly, enabling a structured path toward holistic security maturity. Each criterion was carefully considered to ensure a comprehensive and efficient implementation plan. **Prioritization Criteria:** - **Risk Level**: Controls addressing critical and high-risk threats (identified through threat modeling) are prioritized first - **Compliance Deadlines**: Regulatory requirements and compliance deadlines influence immediate priority - **Technical Complexity**: Controls requiring foundational infrastructure are implemented early to enable subsequent controls - **Dependencies**: Controls that other security measures depend upon are prioritized accordingly - **Resource Availability**: Implementation considers the availability of skilled personnel, tools, and budget - **Business Impact**: Controls protecting business-critical functions and data receive higher priority These criteria work together to create a logical implementation sequence that balances security needs with practical constraints, ensuring that each phase builds on the previous one, addressing the most pressing risks while setting the stage for long-term security improvements. ### 10.2. Phased Implementation Plan #### Phase: IMMEDIATE **Timeline:** 0-1 months **Rationale:** This phase focuses on addressing critical vulnerabilities and compliance blockers to protect the most sensitive data and essential functions immediately. **Controls to Implement:** - Fix XSS vulnerabilities to prevent session token theft - Implement strong RBAC and tenant isolation to prevent cross-tenant data exposure - Enforce basic encryption for sensitive data in transit and at rest - Address critical compliance blockers, such as GDPR and CCPA consent mechanisms **Dependencies:** - Completion of initial threat assessments - Availability of skilled security engineers #### Phase: SHORT-TERM **Timeline:** 1-3 months **Rationale:** These controls build upon immediate security measures, focusing on improving access control adjustments and ensuring that logging and API security mitigate identified threats effectively. **Controls to Implement:** - Enhance user authentication through comprehensive multi-factor authentication - Deploy role-based access controls across the admin dashboard - Implement comprehensive logging and monitoring for all administrative actions - Strengthen API security with input validation and HTTPS protocols - Begin encryption for all sensitive data at rest **Dependencies:** - Completion of TLS Implementation - Completion of multi-factor authentication #### Phase: MEDIUM-TERM **Timeline:** 3-6 months **Rationale:** This phase addresses advanced threat detection and security automation to enhance the overall security posture and prepare for third-party audits. **Controls to Implement:** - Deploy advanced threat detection and response systems - Automate security testing processes, including SAST and DAST - Conduct third-party security audits to assess and improve defenses - Enhance data protection measures for sensitive export and backup files **Dependencies:** - Completion of comprehensive logging and monitoring - Availability of third-party auditors #### Phase: LONG-TERM **Timeline:** 6-12 months **Rationale:** Strategic initiatives to enhance security maturity and prepare the organization for future challenges through continuous improvement and education. **Controls to Implement:** - Implement security maturity enhancements and continuous improvement processes - Deploy advanced AI/ML-based security controls for anomaly detection - Conduct comprehensive penetration testing for all critical systems - Introduce security awareness programs for all personnel **Dependencies:** - Established baseline security posture from earlier phases - Availability of budget for advanced technologies #### Phase: ONGOING **Timeline:** Continuous **Rationale:** Ensure continuous security monitoring, compliance audits, and incident response readiness to maintain a robust security posture. **Controls to Implement:** - Maintain continuous security monitoring and patch management - Conduct regular compliance audits and risk assessments - Ensure incident response readiness and conduct regular drills **Dependencies:** - Established incident response team and procedures ### 10.3. Resource Requirements Skills: Security engineers, Security architects, Web developers, Compliance specialists; Recommended tools: SIEM solutions for logging and monitoring, Vulnerability scanners for testing, Encryption libraries for data protection, API management tools for secure interfaces; Estimated time effort: Approximately 3-6 months for initial phases, with ongoing efforts extending resources as per system complexity and requirements. --- ## 11. Verification and Testing Strategy ### 11.1. Testing Approach Integrate security testing throughout the software development lifecycle (SDLC) with an emphasis on continuous security practices. Balance automated scanning with manual evaluations to prioritize high-risk areas based on business impact, adhering to shift-left security principles by incorporating security testing earlier and continuously. This approach ensures that vulnerabilities are identified and addressed promptly, aligning with both compliance requirements and overall risk management strategies. ### 11.2. Testing Methods | Method | Frequency | Tools | |--------|-----------|-------| | STATIC APPLICATION SECURITY TESTING (SAST) | Every commit/build | SonarQube, Semgrep, Checkmarx | | DYNAMIC APPLICATION SECURITY TESTING (DAST) | Nightly/weekly | OWASP ZAP, Burp Suite, Acunetix | | DEPENDENCY SCANNING | Every build | Snyk, Dependabot, OWASP Dependency-Check | | SECRETS SCANNING | Every commit | TruffleHog, GitLeaks, GitHub Secret Scanning | | CONTAINER/INFRASTRUCTURE SCANNING | Every deployment | Trivy, Clair, Prowler, ScoutSuite | | PENETRATION TESTING | Quarterly or before major releases | Custom scripts, Metasploit, Burp Suite Pro | | SECURITY CODE REVIEW | For critical features | GitHub/GitLab code review, Security checklists | | COMPLIANCE SCANNING | Continuous | AWS Config, Azure Policy, Cloud Custodian | ### 11.3. Compliance Verification Multi-standard compliance (OWASP ASVS, NIST SP 800-53, ISO 27001) will be verified through automated tools and manual checks against regulatory requirements such as GDPR, CCPA, and PCI-DSS. Audit preparation will involve ensuring documentation and evidence collection for external audits, particularly focusing on the handling of sensitive data. This will include maintaining logs for consent events and data access, as well as implementing policies for the retention and secure deletion of personal data. Recommendations will include engaging third-party auditors for comprehensive evaluations to ensure compliance with all applicable regulations. ### 11.4. Continuous Monitoring Implement Security Information and Event Management (SIEM) for real-time monitoring, supported by Intrusion Detection/Prevention Systems (IDS/IPS) to identify and mitigate threats. All logs will be aggregated and analyzed for anomalies, incorporating behavioral analytics to identify patterns indicative of potential security incidents. This integration into incident response processes will ensure prompt action against security events, allowing for a proactive approach to security management. ### 11.5. Key Performance Indicators (KPIs) - Mean time to detect (MTTD) security issues - Mean time to remediate (MTTR) vulnerabilities - Percentage of critical vulnerabilities patched within SLA - Security test coverage percentage - False positive rate in automated scanning - Compliance audit pass rate ### 11.6. Mapping Testing Methods to Security Controls - **SAST**: Verifies controls related to input validation, injection flaws, and hardcoded secrets (OWASP ASVS V2.1, NIST AC-2, ISO 27001 A.9.2.1). - **DAST**: Assesses authentication, authorization, XSS, CSRF, and SQL injection vulnerabilities (OWASP ASVS V2.2, NIST IA-2, ISO 27001 A.9.4.2). - **Dependency Scanning**: Addresses vulnerabilities in third-party libraries and supply chain security (OWASP ASVS V3.9). - **Secrets Scanning**: Detects exposed credentials and API keys (OWASP ASVS V6.1). - **Container/Infrastructure Scanning**: Ensures compliance with configuration management controls (NIST SC-7, ISO 27001 A.14.2.5). - **Penetration Testing**: Validates all high-risk controls (OWASP ASVS V4.1, NIST AC-3). - **Security Code Review**: Focuses on critical code related to authentication, authorization, and cryptographic implementations (OWASP ASVS V2.3, NIST IA-5). - **Compliance Scanning**: Automates checks against applicable compliance standards (GDPR, HIPAA, PCI-DSS). --- ## 12. Validation Report This section presents a comprehensive validation of the security requirements generated throughout this analysis. The validation evaluates the requirements against five key dimensions: completeness, consistency, correctness, implementability, and alignment with business objectives. This assessment ensures that the security requirements are comprehensive, technically sound, and actionable for implementation teams. ### 12.1. Overall Assessment The overall validation score reflects the quality and completeness of the security requirements across five critical dimensions. Each dimension is scored from 0.0 to 1.0, with 1.0 representing excellent coverage and 0.0 indicating significant gaps. **Overall Score:** 0.81/1.0 **Validation Status:** ✅ PASSED The security requirements have met the quality threshold (≥0.8) and are ready for implementation. The requirements demonstrate comprehensive coverage, technical accuracy, and alignment with business objectives. The validation assesses: - **Completeness**: Are all identified security concerns adequately addressed? - **Consistency**: Do requirements align with each other without contradictions? - **Correctness**: Are controls appropriate for the identified risks and correctly applied? - **Implementability**: Are requirements specific, actionable, and feasible to implement? - **Alignment**: Do security requirements align with business requirements and objectives? ### 12.2. Dimension Scores | Dimension | Score | Status | |-----------|-------|--------| | Completeness | 0.72 | ⚠️ | | Consistency | 0.88 | ✅ | | Correctness | 0.84 | ✅ | | Implementability | 0.76 | ⚠️ | | Alignment | 0.86 | ✅ | **Score Interpretation:** - ✅ 0.8-1.0: Excellent - ⚠️ 0.7-0.79: Acceptable (minor improvements needed) - ❌ <0.7: Needs significant improvement ### 12.3. Detailed Feedback Summary of assessment: Strengths: The security mapping is broad and maps most high-level functional requirements to appropriate OWASP/NIST/ISO controls. Multi-tenant isolation, API security for the external solver, encryption, logging/audit, privacy, and AI/ML-specific considerations are all present. The cross-functional controls give a good foundational set (encryption, logging, input validation, access control, privacy). Key gaps and prioritized actionable recommendations (specific and implementable): 1) Strong authentication & account protection (High priority) - Add explicit Multi-Factor Authentication (MFA) requirement for ADMIN and MANAGER roles and optional for EMPLOYEE. Specify supported methods (TOTP, WebAuthn, SMS discouraged) and fallback/legacy flows. Add account lockout and adaptive rate-limiting/brute-force protections with thresholds and lockout durations. - Specify password policy details (min length, complexity, reuse prevention, rotation policy if used) and server-side checks. 2) Session and cookie security (High priority) - Require secure, HttpOnly, SameSite cookies for session tokens where applicable; define session idle and absolute timeouts and administrative forced logout/invalidation (token revocation) for role/status changes. 3) Secrets, keys, and certificate management (High priority) - Add explicit KMS usage, secret rotation frequency, storage rules (no secrets in repo), and CI/CD secrets handling. Define TLS certificate lifecycle and mutual TLS for solver integration if used. 4) Tenant isolation and authorization specifics (High priority) - Strengthen multi-tenant requirement with concrete implementation expectations: include tenant_id in every API call authenticated principal, enforce DB-level isolation (row-level security or separate schemas), and require automated tests that attempt cross-tenant access. Define manager scoping: managers can only CRUD within their company and cannot escalate privileges across tenants — add test cases. 5) Data lifecycle, GDPR/CCPA operations and deletion (High priority) - Add implementable privacy controls: retention schedules, deletion workflows (soft-delete vs hard-delete), data export redaction rules per role, and detailed end-to-end deletion verification for Right-to-Erasure. Capture legal basis and consent metadata schema for each processing purpose. 6) Export and DLP controls (High priority) - Specify per-export templates and fields, role-based export approvals, automatic redaction rules for sensitive fields (health reasons, personal identifiers), and logging/alerting for mass exports. Consider rate limits and approval workflow for large exports. 7) Incident response, monitoring, and alerting (Medium-High priority) - Define alerting criteria for suspicious activity (mass failed logins, unusual export volume, solver anomalies), mean time to detect/respond SLAs, and include playbooks for solver compromise/data leakage and data breach notifications requirements for regulatory compliance. 8) AI/ML and solver-specific hardening (Medium priority) - Replace generic “prompt injection” language with structured payload hardening: define solver input schema, strict schema validation, payload size limits, payload signing (HMAC) and response signature verification or integrity checks, sandboxing of parsing code, and anomaly detection for unexpected solver outputs. Record solver-run provenance and keep solver inputs/outputs in the audit trail but redact PII where unnecessary. - Add a supplier security requirement for the external solver (attestation, SOC2/ISO evidence) and contractual SLA for incident handling. 9) Logging, retention, and tamper-evidence (Medium priority) - Specify retention durations per log type, access controls for logs, WORM or signed-log strategy for consent and audit-critical logs, and procedures for secure log archiving and destruction. 10) Secure development & supply chain (Medium priority) - Add requirements for dependency scanning, SCA, code signing, CI/CD pipeline hardening, and vulnerability management (CVE triage timeline and patching SLAs). 11) Operational and implementability details (Medium priority) - Convert high-level controls into explicit, testable acceptance criteria: e.g., token expiry (access token 15m, refresh 7d), password policy rules, MFA enforcement rules, RBAC matrix mapping roles to API endpoints, RLS policy examples, export redaction rules, logging fields schema (actor, ip, timestamp, resource, before/after), solver payload schema, and job queue encryption/ACLs. 12) Testing and verification (Medium priority) - Add concrete test cases: RBAC tests per endpoint, cross-tenant access attempts, fuzzing/Unicode tests for i18n, XSS tests across calendar/tables, CSRF tests for state-changing actions, solver-mock negative tests (malformed responses), and data-deletion verification for GDPR. Miscellaneous improvements: - Clarify applicability of some regulations (e.g., COPPA only if under-13 users are expected) to avoid unnecessary controls. - Provide concrete retention durations, log retention and deletion policies, and evidence requirements for audits. - Add marketplace/operational controls for admin console access (IP allowlisting, privilege escalation approval workflows). If you want, I can produce a prioritized implementation backlog mapping each recommended addition to acceptance tests, API-level requirements, and sample policy text for contracts/PIA templates. --- ## Appendix A: Original Requirements Document ``` Shift Management System Requirements We need to build a web application for managing employee shifts, assignments, and scheduling with automated optimization capabilities. Key Features: 1. User Management - User registration with email verification - Authentication (credentials and Google OAuth) - Password reset - Role-based access control (ADMIN, MANAGER, EMPLOYEE) - User status management (ACTIVE, INACTIVE, UNVERIFIED) - User profile management - Admin/Manager user CRUD (a manager can CRUD only his company’s employees) - Company assignment for users 2. Company Management - Company CRUD (Admin only) - Multi-tenant support (users, shift types, skills scoped to companies) - Company assignment for managers and employees 3. Shift Types - Create, read, update, delete shift types - Define start and end times - Associate required skills with shift types - Company-scoped shift types 4. Shift Assignment - Manual shift assignment (create, update, delete) - Shift status tracking (SCHEDULED, CONFIRMED, COMPLETED, CANCELLED, NO_SHOW) - Calendar view for shifts - Shift filtering and search (by user, shift type, status, date) - Pagination and sorting - Shift preview on a calendar view 5. Auto-Assignment (Optimization) - Automated shift assignment via external solver API - Date range selection for auto-assignment - Real-time solution polling and status updates - Solution scoring (hard/soft constraints) - Constraint violation analysis and reporting - Preview of generated assignments before acceptance - Accept/reject generated assignments - Validation to prevent duplicate shifts in date ranges 6. Shift Preferences - Date-specific preferences (DESIRED/UNDESIRED) - Employee preference management - Preference tracking for optimization 7. Unavailable Dates - Leave management (SICK_LEAVE, VACATION, PERSONAL_LEAVE, UNPAID_LEAVE, OTHER) - Date range unavailability - Reason tracking - Employee and manager access 8. Skills Management - Skill CRUD - Associate skills with users - Associate required skills with shift types - Skill-based matching for shift assignments - Company-scoped skills 9. Data Export - Export shifts, users, companies, skills, shift types, preferences, and unavailable dates - Export formats: CSV and XLSX 10. External API Integration - Integration with external optimization solver (Timefold backend) - Asynchronous job processing with polling - Solution status tracking - Constraint analysis via external API - Payload generation for solver - Solution parsing and validation 11. Internationalization - Multi-language support - Translated UI elements - Localized date/time formatting 12. User Interface - Responsive sidebar navigation - Pagination for data tables - Sorting and filtering - Search functionality - Calendar views - Alert/notification system - Breadcrumb navigation - Legal documents (Privacy Policy, Terms of Service) The application will store user data, company information, shift assignments, preferences, and integration data. It will integrate with external optimization services and support multi-tenant company workspaces. ``` --- ## Appendix B: Glossary | Term | Definition | |------|------------| | ASVS | Application Security Verification Standard (OWASP) | | STRIDE | Spoofing, Tampering, Repudiation, Information Disclosure, Denial of Service, Elevation of Privilege | | SAST | Static Application Security Testing | | DAST | Dynamic Application Security Testing | | MFA | Multi-Factor Authentication | | RBAC | Role-Based Access Control | | PII | Personally Identifiable Information | | PHI | Protected Health Information | | GDPR | General Data Protection Regulation | | HIPAA | Health Insurance Portability and Accountability Act | | PCI-DSS | Payment Card Industry Data Security Standard | --- ## Appendix C: Complete Threat List This appendix contains the complete list of all identified threats with full descriptions and mitigation strategies. Threats are organized by risk level for easy reference. ### Critical Risk Threats **THR-001** - Frontend Layer (SPA) - Calendar & Tables - **Category:** Information Disclosure / Spoofing - **Likelihood:** High | **Impact:** High - **Risk Level:** Critical - **Description:** Reflected or stored XSS in UI (calendar, shift preview, user profile) allows an attacker to run JS in another user's session, exfiltrate session tokens, hijack accounts, or perform actions on behalf of the user. - **Mitigation Strategy:** Enforce output encoding/escaping on all user-supplied content; use a strict Content Security Policy (CSP) with nonces; sanitize inputs server-side and client-side, avoid innerHTML; use frameworks' safe templating; review third-party libs; run regular automated and manual XSS testing (DAST/SAST). **THR-008** - Application Services - Authentication - **Category:** Spoofing - **Likelihood:** High | **Impact:** High - **Risk Level:** Critical - **Description:** Credential stuffing, weak passwords, or lack of MFA leads to account takeover of ADMIN/MANAGER accounts allowing large-scale damage. - **Mitigation Strategy:** Enforce strong password policies, rate-limit authentication attempts, use account lockouts or adaptive throttling, require MFA for privileged roles, integrate breached-password checks and anomaly detection, encourage SSO (Google) with secure config. ### High Risk Threats **THR-003** - Frontend Layer (Token Handling) - **Category:** Spoofing / Information Disclosure - **Likelihood:** Medium | **Impact:** High - **Risk Level:** High - **Description:** Session tokens or OAuth tokens stored insecurely in localStorage or accessible JS can be stolen via XSS or malicious extensions, enabling account takeover. - **Mitigation Strategy:** Use secure, httpOnly cookies with SameSite attributes for session tokens; minimize token lifetime; use token rotation and refresh tokens stored securely; implement strong CSP and XSS mitigations; detect anomalous sessions and revoke tokens. **THR-004** - Frontend Layer / External Services (Google OAuth) - **Category:** Spoofing - **Likelihood:** Medium | **Impact:** High - **Risk Level:** High - **Description:** Open redirect or incorrect OAuth redirect URI validation allows attackers to capture authorization codes or tokens via a malicious callback, leading to account takeover. - **Mitigation Strategy:** Strictly validate redirect_uris against allowlist; use PKCE for OAuth flows; verify state parameter and nonce; enforce HTTPS on callback URIs; monitor for abnormal OAuth grant patterns. **THR-005** - Edge Layer (CDN/WAF/TLS) - **Category:** Information Disclosure / Tampering - **Likelihood:** Medium | **Impact:** High - **Risk Level:** High - **Description:** TLS termination or CDN misconfiguration (weak ciphers, expired certs, missing HSTS) could allow MitM, protocol downgrade, or data interception between clients and edge. - **Mitigation Strategy:** Enforce strong TLS configuration (TLS1.2+ recommended, prefer 1.3), HSTS, secure certificate lifecycle management, automate renewals, monitor TLS telemetry, enable HTTP Strict Transport Security, and perform periodic TLS scans. **THR-006** - Edge Layer (WAF & API Gateway) - **Category:** Tampering / Information Disclosure - **Likelihood:** Medium | **Impact:** High - **Risk Level:** High - **Description:** WAF rule bypass or insufficient WAF rules allow injection payloads (SQLi, XSS) to reach backend; misconfigured gateway could leak internal details via verbose errors. - **Mitigation Strategy:** Implement layered WAF rules including OWASP top 10 protections; use positive allowlists for APIs; sanitize error messages; enable anomaly detection and tuning; use gateway-level request validation and schema checks. **THR-009** - Application Services - Password Reset - **Category:** Spoofing / Repudiation - **Likelihood:** Medium | **Impact:** High - **Risk Level:** High - **Description:** Weak or predictable password reset tokens, or emails sent with insufficient verification, allow attackers to reset passwords and take over accounts. - **Mitigation Strategy:** Use long, cryptographically secure, single-use tokens with short TTL; bind token to user agent/IP metadata; log and notify users of resets; rate limit reset requests; verify identity for high-privilege resets; avoid leaking account existence info. **THR-010** - Application Services - OAuth Integration - **Category:** Spoofing - **Likelihood:** Medium | **Impact:** High - **Risk Level:** High - **Description:** Compromised or replayed OAuth tokens from Google OAuth could be used to impersonate users if token validation is insufficient. - **Mitigation Strategy:** Validate ID token signatures and claims server-side; check token expiry and audience; implement token revocation and rotation; use PKCE and state parameters; map OAuth identities carefully to internal accounts with additional checks for privileged ops. **THR-011** - Application Services - RBAC / Multi-tenant Checks - **Category:** Elevation of Privilege - **Likelihood:** Medium | **Impact:** High - **Risk Level:** High - **Description:** Broken access control or insufficient tenant scoping may allow a manager/admin/employee to view or modify data for other companies or elevate privileges. - **Mitigation Strategy:** Implement centralized, fine-grained RBAC and tenant authorization checks on the server side (deny-by-default); perform authorization at every entry point; use automated tests for tenant isolation; include ABAC claims (tenant_id, role) in tokens and validate them server-side. **THR-012** - Application Services - Multi-Tenancy - **Category:** Information Disclosure / Tampering - **Likelihood:** Medium | **Impact:** High - **Risk Level:** High - **Description:** Data leakage across tenants due to incorrect SQL queries, shared caches, or improper tenant-scoped identifiers could expose PII and shift data of other companies. - **Mitigation Strategy:** Use strict tenant_id scoping in queries, prepared statements, row-level security or separate schemas per tenant if appropriate; segregate caches (prefix keys by tenant_id), encrypt data at rest, review multi-tenant design in threat model. **THR-013** - Application Services - Shift APIs / DB Layer - **Category:** Tampering (Injection) - **Likelihood:** Medium | **Impact:** High - **Risk Level:** High - **Description:** SQL injection, NoSQL injection or command injection via poorly validated parameters (search, filtering, sorting) could lead to data theft or corruption. - **Mitigation Strategy:** Use parameterized queries/ORMs, input validation and canonicalization, allowlist sorting/filtering fields, use least privilege DB accounts, run SAST and SQLi testing, employ web application firewall rules tailored to injections. **THR-014** - Auto-Assignment (Optimizer Orchestration) - **Category:** Tampering / Integrity - **Likelihood:** Medium | **Impact:** High - **Risk Level:** High - **Description:** An attacker could manipulate optimization payloads, acceptance flow, or solver responses (malformed or malicious solution) to force incorrect assignments (e.g., assign unauthorized employees to shifts) or bypass constraints. - **Mitigation Strategy:** Sign and validate payloads and responses; use mutual TLS or API keys with IP allowlisting for Timefold; validate solver results against business rules server-side; sandbox and review solutions; require manager approval for critical changes; maintain an immutable audit trail. **THR-016** - Application Services - Audit & Logging - **Category:** Repudiation - **Likelihood:** Medium | **Impact:** High - **Risk Level:** High - **Description:** Insufficient or tamperable audit logs allow malicious actors to erase traces of actions (shift changes, acceptance) or administrators to repudiate actions. - **Mitigation Strategy:** Append-only audit logs, write to immutable storage or WORM-enabled object storage, centralize logs to a managed SIEM, sign or hash log entries, restrict log access, and monitor for log deletion events. **THR-017** - Data Layer - Object Storage (Exports/Artifacts) - **Category:** Information Disclosure - **Likelihood:** Medium | **Impact:** High - **Risk Level:** High - **Description:** Misconfigured S3-like buckets or signed URLs with overly long TTLs could leak CSV/XLSX exports or optimizer artifacts publicly, exposing PII and shift data. - **Mitigation Strategy:** Enforce bucket policies denying public access, use short-lived signed URLs, server-side access control by tenant, encrypt objects at rest, log and monitor object access, and scan object buckets for public exposure. **THR-018** - Data Layer - Managed RDBMS - **Category:** Information Disclosure - **Likelihood:** Medium | **Impact:** High - **Risk Level:** High - **Description:** Database credentials stored insecurely (in code, misconfigured secrets management) or overly-permissive DB accounts allow attackers or insiders to dump tenant data. - **Mitigation Strategy:** Use managed secrets (KMS/Secret Manager), rotate credentials regularly, enforce least privilege DB roles, network isolate DB (VPC), enable encryption at rest, enable DB auditing, and use IAM-based auth where available. **THR-020** - Data Layer - Cache/Session Store (Redis) - **Category:** Spoofing / Information Disclosure - **Likelihood:** Medium | **Impact:** High - **Risk Level:** High - **Description:** Compromise of cache/session store could allow theft of session tokens or tenant-scoped cached data, enabling session hijacking or data leakage. - **Mitigation Strategy:** Network-restrict access to cache (VPC security groups), enable AUTH and TLS on Redis, do not store long-lived secrets in cache, rotate session tokens and invalidate sessions on suspicious activity, isolate keys per tenant, and monitor access. **THR-021** - External Services - Timefold Solver Integration - **Category:** Information Disclosure / Tampering - **Likelihood:** Medium | **Impact:** High - **Risk Level:** High - **Description:** Sensitive optimization payloads (employee availability, leave, skills) transmitted to or stored by the external solver may be exposed if the external service is compromised or communication is intercepted. - **Mitigation Strategy:** Minimize sensitive data sent to external solver; use strong transport security (mTLS), enable payload encryption where possible, contractually require security controls from provider, implement data minimization and anonymization, and maintain an audit of payloads sent. **THR-022** - External Services - Timefold Solver / Solver Responses - **Category:** Tampering / Elevation of Privilege - **Likelihood:** Medium | **Impact:** High - **Risk Level:** High - **Description:** Malicious or malformed solver responses could instruct the application to create invalid/privileged assignments or bypass constraints if insufficiently validated. - **Mitigation Strategy:** Validate solver outputs against server-side business rules and constraints before applying; require manager acceptance for significant changes; verify score integrity; sandbox parsing logic and implement strict schema validation for responses. **THR-023** - External Services - Email Delivery Provider - **Category:** Information Disclosure / Repudiation - **Likelihood:** Medium | **Impact:** High - **Risk Level:** High - **Description:** Compromised email provider or mis-sent transactional emails (password resets, verification) can be used for phishing or account takeover or accidental leakage of PII. - **Mitigation Strategy:** Use a reputable provider with security SLAs; sign emails (DKIM/SPF/DMARC), limit PII in emails, use templated safe content, rate-limit mass emails, monitor bounce/reputation, and provide out-of-band verification for critical operations. **THR-024** - External Services - Google OAuth Provider - **Category:** Spoofing - **Likelihood:** Medium | **Impact:** High - **Risk Level:** High - **Description:** Compromise of Google OAuth accounts or misconfiguration (improperly mapped accounts) allowing attackers to authenticate as other users or link accounts incorrectly. - **Mitigation Strategy:** Implement verification steps when linking OAuth accounts; check verified email claims; require additional verification for privileged role assignment; detect and alert on suspicious OAuth logins (new IP/geo), and support account unlinking and emergency access removal. **THR-030** - User Interface (Cookies / Session) - **Category:** Elevation of Privilege - **Likelihood:** Medium | **Impact:** High - **Risk Level:** High - **Description:** XSS or insecure cookie settings allow session cookie theft leading to privilege escalation (e.g., attacker operates as manager/admin). - **Mitigation Strategy:** Use httpOnly and Secure cookies with SameSite attributes, rotate sessions on privilege changes, provide session management UI for users, invalidate sessions on suspicious activity, and enforce MFA for privileged actions. ### Medium Risk Threats **THR-002** - Frontend Layer & Application Services (Forms & Actions) - **Category:** Tampering (CSRF) - **Likelihood:** Medium | **Impact:** Medium - **Risk Level:** Medium - **Description:** Cross-Site Request Forgery: authenticated users could be induced to submit state-changing requests (assignments, accept generated shifts) from another origin. - **Mitigation Strategy:** Implement anti-CSRF tokens on state-changing endpoints or use SameSite=strict/strictish cookies for session tokens; require explicit user confirmation for risky ops (e.g., commit auto-assignment); validate Origin/Referer headers; use CORS allowlist. **THR-007** - Edge Layer (Rate Limiting) - **Category:** Denial of Service - **Likelihood:** Medium | **Impact:** Medium - **Risk Level:** Medium - **Description:** Absence or weak rate limiting allows brute-force, enumeration, or abusive polling (e.g., optimizer polling) causing backend overload or service degradation. - **Mitigation Strategy:** Apply per-IP, per-user, and per-endpoint rate limits; exponential backoff; CAPTCHAs for suspicious flows (login); token bucket throttling; protect long-polling endpoints with quotas; monitor metrics and alert on spikes. **THR-015** - Application Services - Background Jobs / Queue - **Category:** Denial of Service / Tampering - **Likelihood:** Medium | **Impact:** Medium - **Risk Level:** Medium - **Description:** Queue or job system abuse (poisoned jobs, replayed jobs, or malformed payloads) can cause failures in optimizer orchestration, duplicate processing, or resource exhaustion. - **Mitigation Strategy:** Validate and sanitize queued payloads, enforce max job size and rate limits, implement dead-letter queues and idempotency tokens, use job signing or auth, monitor queue depth and job error rates, and use per-tenant job quotas. **THR-019** - Data Layer - Backups & Export Files - **Category:** Information Disclosure - **Likelihood:** Medium | **Impact:** Medium - **Risk Level:** Medium - **Description:** Backups, exported CSV/XLSX, or optimizer artifacts containing PII may be retained insecurely or sent to external systems without encryption, leading to data leakage. - **Mitigation Strategy:** Encrypt backups and exports at rest and in transit, restrict access to backups, apply retention and deletion policies, sanitize exports (redact sensitive fields when possible), and log export/download events per tenant. **THR-025** - External Services - Monitoring & Logging - **Category:** Information Disclosure - **Likelihood:** Medium | **Impact:** Medium - **Risk Level:** Medium - **Description:** Sensitive data (PII, tokens) in logs or monitoring metrics sent to third-party services may leak across organizations or be accessible to unauthorized parties. - **Mitigation Strategy:** Redact or mask PII/tokens before sending to logs; use sampling and data minimization; restrict access to monitoring dashboards; apply retention policies; use encryption for logs in transit and at rest. **THR-026** - Data Export Feature (CSV/XLSX) - **Category:** Tampering / Information Disclosure - **Likelihood:** Medium | **Impact:** Medium - **Risk Level:** Medium - **Description:** Exported spreadsheets containing user-entered fields could include CSV injection (formula injection) or contain sensitive PII unexpectedly; exported files may be downloaded using unsecured links. - **Mitigation Strategy:** Sanitize cell content (prefix ' or use safe formatting to avoid formula execution), require authentication to download, use short-lived signed URLs, perform pre-export redaction options, and log export events per user and tenant. **THR-027** - Auto-Assignment (Concurrency) - **Category:** Tampering / Denial of Service - **Likelihood:** Medium | **Impact:** Medium - **Risk Level:** Medium - **Description:** Race conditions between auto-assignment job acceptance and manual edits can create duplicate shifts, gaps, or inconsistent state across tenants. - **Mitigation Strategy:** Use transactional operations, optimistic concurrency control (versioning), idempotency tokens for operations, and perform final validation before commit; provide conflict resolution UI and alerting. **THR-028** - API Gateway / Frontend Polling (Optimizer Polling) - **Category:** Denial of Service - **Likelihood:** Medium | **Impact:** Medium - **Risk Level:** Medium - **Description:** Abuse of real-time polling endpoints (frequent polling for optimization status) can overwhelm backend services, increasing costs and causing outages. - **Mitigation Strategy:** Implement backoff, push mechanisms (WebSockets/Server-Sent Events) with authenticated subscribe, enforce polling rate limits, introduce caching for status, and apply quotas per tenant. **THR-029** - Internationalization / Date-Time Handling - **Category:** Tampering / Information Disclosure - **Likelihood:** Medium | **Impact:** Medium - **Risk Level:** Medium - **Description:** Locale and timezone misparsing or injection of malformed locale strings could cause incorrect shift calculations, exposing different tenants' data or mis-scheduling employees. - **Mitigation Strategy:** Normalize and validate all locale/timezone inputs against known allowlists, store all times in UTC and render locale-aware only in UI, add unit and integration tests for date conversions, and log unexpected locale values. **Total Threats:** 30 --- ## Appendix D: Complete Requirements Traceability Matrix This appendix provides complete end-to-end traceability from requirements through threats to controls and verification. ### Full Traceability Table | Req ID | Requirement | Category | Sensitivity | Threat IDs | Security Controls | Priority | Verification | Status | |--------|-------------|----------|-------------|------------|----------------|----------|--------------|--------| | REQ-001 | User registration with email verification and acco... | Authentication / Identity Management | High | THR-001, THR-002, THR-003 +7 | [OWASP] V2.1, [NIST] AC-2, [ISO27001] A.9.2.1 +1 | Critical | Review implementation of email verification flow, inspect token properties (single-use, expiry), and test account behavior before and after verification., Audit account management procedures, review logs of account create/disable/delete events, and verify policy enforcement through test cases. | Pending | | REQ-002 | Authentication supporting credentials-based login ... | Authentication / Integration | High | THR-003, THR-004, THR-008 +2 | [OWASP] V2.2, [NIST] IA-2, [ISO27001] A.9.4.2 +1 | Critical | Examine policies for federated identity, test SSO flows for proper authentication, and verify credential handling meets organizational standards., Inspect token storage methods, test revocation and refresh flows, and review scope requests during OAuth handshake. | Pending | | REQ-003 | Password reset and account recovery flows with sec... | Authentication / Account Recovery | High | THR-001, THR-003, THR-004 +7 | [OWASP] V2.3, [NIST] IA-5 (5), [OWASP] V5.1 +1 | Critical | Review recovery policies, validate multi-step verification for sensitive accounts, and inspect logs of recovery events., Test reset flows for token reuse, expiry, and ensure resets require verified contact; perform abuse-case testing. | Pending | | REQ-004 | Role-based access control (ADMIN, MANAGER, EMPLOYE... | Authorization / Multi-tenancy | High | THR-001, THR-002, THR-003 +7 | [OWASP] V4.1, [NIST] AC-3, [ISO27001] A.9.1.2 +1 | Critical | Audit automation integrations, simulate HR-driven status changes, and verify system enforces new statuses immediately., Review access control policy documentation and interview personnel to confirm implementation. | Pending | | REQ-005 | User profile management, including personal detail... | Data Management / User Management | Medium | THR-001, THR-002, THR-008 +5 | [OWASP] V4.6, [NIST] AC-6, [ISO27001] A.9.2.2 +1 | High | Review code paths for profile update endpoints, perform unauthorized modification tests, and inspect audit logs., Check privilege assignments for profile-management components and test unauthorized assignment attempts. | Pending | | REQ-006 | Admin-only company CRUD and multi-tenant data isol... | Multi-tenant Administration | High | THR-001, THR-002, THR-005 +7 | [OWASP] V14.1, [NIST] SC-7, [ISO27001] A.13.2.1 +1 | Critical | Review data access code, run multi-tenant isolation tests (attempt cross-tenant reads/writes), and inspect database policies., Review policy documents and sample transfer approvals; test that transfers are blocked or logged when not permitted. | Pending | | REQ-007 | Create, read, update, delete shift types with star... | Scheduling / Configuration | Medium | THR-001, THR-002, THR-012 +7 | None | Medium | Manual Review | Pending | | REQ-008 | Manual shift assignment: create, update, delete sh... | Scheduling / Operations | High | THR-001, THR-002, THR-004 +7 | [OWASP] V4.4, [NIST] AU-2, [ISO27001] A.12.4.1 +1 | Critical | Inspect logs for the required events, retention configuration, and access controls around logs., Review permission mappings and test that lower-privileged roles cannot modify shifts. | Pending | | REQ-009 | Shift status lifecycle and tracking (SCHEDULED, CO... | Scheduling / Audit & Reporting | Medium | THR-001, THR-002, THR-012 +7 | [NIST] AU-6, [OWASP] V10.1, [ISO27001] A.12.4.3 +1 | High | Check logs for operator entries and review processes for manual status changes., Review change records for status transition rule updates and verify approvals were enforced. | Pending | | REQ-010 | Calendar view with shift preview, search, filterin... | User Interface / Scheduling | Low | THR-001, THR-002, THR-011 +7 | None | Medium | Manual Review | Pending | | REQ-011 | Automated shift assignment via external solver API... | Optimization / Integration | High | THR-001, THR-002, THR-004 +7 | [OWASP] V13.1, [NIST] SA-9, [ISO27001] A.15.1.1 +1 | Critical | Inspect TLS configuration, perform MITM tests, and verify payload signatures if implemented., Review supplier contracts, interface security documentation, and test compliance with the defined integration policy. | Pending | | REQ-012 | Asynchronous job processing for optimization reque... | Integration / System Operations | Medium | THR-014, THR-015, THR-021 +1 | [NIST] SC-13, [OWASP] V14.3, [ISO27001] A.12.1.1 +1 | Critical | Inspect integrity verification code paths and attempt to submit tampered payloads to confirm detection., Inspect queue ACLs, test unauthorized enqueue/dequeue attempts, and validate payload schema checks. | Pending | | REQ-013 | Solution scoring (hard/soft constraint metrics), c... | Optimization / Reporting | Medium | THR-014, THR-021, THR-022 | [OWASP] V11.2, [NIST] PM-22, [ISO27001] A.18.1.4 +1 | High | Inspect audit logs for scoring events and test correlation between algorithm runs and generated logs., Review privacy assessments and validate that logs/reporting exclude unnecessary personal data or are appropriately protected. | Pending | | REQ-014 | Validation to prevent duplicate shifts across the ... | Scheduling / Data Integrity | High | THR-002, THR-004, THR-010 +7 | None | Medium | Manual Review | Pending | | REQ-015 | Employee shift preferences management with date-sp... | Scheduling / Preferences | Medium | THR-001, THR-002, THR-007 +7 | [ISO27001] A.18.1.4, [NIST] PL-4, [OWASP] V1.5 +1 | High | Review privacy documentation and confirm preference handling is aligned with policy and retention rules., Test access to preference records from different roles and verify unauthorized reads are blocked. | Pending | | REQ-016 | Unavailable dates and leave management (SICK_LEAVE... | Scheduling / HR Data | High | THR-003, THR-013, THR-014 +5 | [ISO27001] A.18.1.4, [NIST] PL-4, [NIST] MP-6 +1 | Critical | Review data classification, access controls, and privacy handling for leave data., Provide PIA output and evidence of mitigations (pseudonymization, restricted access). | Pending | | REQ-017 | Skill management: CRUD for skills, skills associat... | Scheduling / Workforce Management | Low | THR-001, THR-002, THR-010 +7 | [NIST] AC-3 (5), [OWASP] V4.2, [ISO27001] A.9.2.2 +1 | High | Review provisioning logs and sample attribute provenance to ensure correct assignment., Attempt to alter skill attributes via API/UI and confirm authorization prevents incorrect matching. | Pending | | REQ-018 | Data export in CSV and XLSX for entities: shifts, ... | Data Management / Reporting | High | THR-001, THR-002, THR-005 +7 | [ISO27001] A.18.1.4, [NIST] PL-4, [NIST] MP-6 +1 | Critical | Review data classification, access controls, and privacy handling for leave data., Provide PIA output and evidence of mitigations (pseudonymization, restricted access). | Pending | | REQ-019 | External API integration with Timefold solver: sec... | Integration / Security | High | THR-003, THR-004, THR-006 +7 | [OWASP] V11.2, [NIST] PM-22, [ISO27001] A.18.1.4 +1 | High | Inspect audit logs for scoring events and test correlation between algorithm runs and generated logs., Review privacy assessments and validate that logs/reporting exclude unnecessary personal data or are appropriately protected. | Pending | | REQ-020 | Internationalization: multi-language support for U... | User Experience / Localization | Low | THR-001, THR-002, THR-010 +7 | [OWASP] V9.7, [NIST] SC-17, [ISO27001] A.14.2.5 +1 | High | Run locale-specific input validation tests and check canonicalization outputs., Test inputs with various Unicode characters and locale-specific formats to detect XSS or parsing issues. | Pending | | REQ-021 | User interface capabilities: responsive sidebar na... | User Interface / Usability | Low | THR-001, THR-002, THR-010 +7 | [OWASP] V9.2, [NIST] SI-10, [ISO27001] A.12.2.1 +1 | Critical | Review server-side validation for UI query parameters and inspect error messages for sensitive info., Check secure development artifacts, dependency scans, and UI security test results. | Pending | | REQ-022 | Audit logging and notifications: record critical o... | Security / Compliance | High | THR-001, THR-002, THR-010 +7 | None | Medium | Manual Review | Pending | | REQ-023 | Legal and privacy: present Privacy Policy, Terms o... | Compliance / Legal | High | THR-002, THR-004, THR-005 +7 | [NIST] AU-2, [ISO27001] A.18.1.4, [OWASP] V10.3 +1 | Critical | Review consent logs, verify they contain required fields, and test retrieval for audit scenarios., Verify retention of document versions and sample consent records match user acknowledgments. | Pending | | REQ-024 | Operational controls: per-tenant configuration, ra... | Operations / Reliability | Medium | THR-004, THR-015, THR-019 +5 | None | Medium | Manual Review | Pending | | REQ-025 | Data protection controls: encryption at rest and i... | Security / Data Protection | High | THR-005, THR-011, THR-012 +7 | None | Medium | Manual Review | Pending | **Total Requirements Tracked:** 25 ### Detailed Requirement Mappings The following section provides detailed traceability for each requirement: #### REQ-001: User registration with email verification and account lifecycle (UNVERIFIED -> ACTIVE/INACTIVE) **Related Threats:** - **THR-001**: Reflected or stored XSS in UI (calendar, shift preview, user profile) allows an ... - **THR-002**: Cross-Site Request Forgery: authenticated users could be induced to submit state... - **THR-003**: Session tokens or OAuth tokens stored insecurely in localStorage or accessible J... - **THR-004**: Open redirect or incorrect OAuth redirect URI validation allows attackers to cap... - **THR-008**: Credential stuffing, weak passwords, or lack of MFA leads to account takeover of... - *...and 5 more threats* **Security Controls:** - **[OWASP] V2.1**: [OWASP] Verify new user registrations via email or other out-of-band mechanisms to ensur... - **[NIST] AC-2**: [NIST] The organization manages information system accounts, including account creation... - **[ISO27001] A.9.2.1**: [ISO27001] A formal user registration and de-registration process shall be implemented to e... - **[NIST] IA-5**: [NIST] Manage, distribute, and revoke credentials and authenticators throughout the acc... **Verification:** Review implementation of email verification flow, inspect token properties (single-use, expiry), and test account behavior before and after verification., Audit account management procedures, review logs of account create/disable/delete events, and verify policy enforcement through test cases., Review credential lifecycle processes, test revocation and re-issuance flows, and inspect logs for authenticator events., Inspect documented procedures and sample records for adherence; validate that de-registration revokes access promptly. **Priority:** Critical | **Status:** Pending --- #### REQ-002: Authentication supporting credentials-based login and Google OAuth (SSO) **Related Threats:** - **THR-003**: Session tokens or OAuth tokens stored insecurely in localStorage or accessible J... - **THR-004**: Open redirect or incorrect OAuth redirect URI validation allows attackers to cap... - **THR-008**: Credential stuffing, weak passwords, or lack of MFA leads to account takeover of... - **THR-010**: Compromised or replayed OAuth tokens from Google OAuth could be used to imperson... - **THR-024**: Compromise of Google OAuth accounts or misconfiguration (improperly mapped accou... **Security Controls:** - **[OWASP] V2.2**: [OWASP] Support secure authentication including credential-based and federated authentic... - **[NIST] IA-2**: [NIST] Identify and authenticate organizational users using authenticators and, where a... - **[ISO27001] A.9.4.2**: [ISO27001] Secure log-on procedures shall be implemented, where appropriate supporting sing... - **[OWASP] V5.3**: [OWASP] Ensure tokens are validated, scoped, stored securely, and revoked when necessary... **Verification:** Examine policies for federated identity, test SSO flows for proper authentication, and verify credential handling meets organizational standards., Inspect token storage methods, test revocation and refresh flows, and review scope requests during OAuth handshake., Review OAuth/OIDC implementation, verify token validation, scope restrictions, and perform token replay/forgery tests., Validate the log-on workflow, verify session creation after SSO, and review session timeout and logout behavior. **Priority:** Critical | **Status:** Pending --- #### REQ-003: Password reset and account recovery flows with secure tokenized links and rate-limiting **Related Threats:** - **THR-001**: Reflected or stored XSS in UI (calendar, shift preview, user profile) allows an ... - **THR-003**: Session tokens or OAuth tokens stored insecurely in localStorage or accessible J... - **THR-004**: Open redirect or incorrect OAuth redirect URI validation allows attackers to cap... - **THR-008**: Credential stuffing, weak passwords, or lack of MFA leads to account takeover of... - **THR-009**: Weak or predictable password reset tokens, or emails sent with insufficient veri... - *...and 5 more threats* **Security Controls:** - **[OWASP] V2.3**: [OWASP] Implement secure password reset flows using verified contact channels and protec... - **[NIST] IA-5 (5)**: [NIST] Establish policies and mechanisms for managing password resets and recovery in a... - **[OWASP] V5.1**: [OWASP] Recovery tokens and one-time use links must be single-use, short-lived, and prot... - **[ISO27001] A.9.2.3**: [ISO27001] Ensure controlled management of authentication data and password resets, includi... **Verification:** Review recovery policies, validate multi-step verification for sensitive accounts, and inspect logs of recovery events., Test reset flows for token reuse, expiry, and ensure resets require verified contact; perform abuse-case testing., Review privileged reset controls, sampling of privileged account reset logs, and policy documentation., Inspect token generation and storage, attempt token replay tests, and verify expiry enforcement. **Priority:** Critical | **Status:** Pending --- #### REQ-004: Role-based access control (ADMIN, MANAGER, EMPLOYEE) with per-company scoping and user status flags ... **Related Threats:** - **THR-001**: Reflected or stored XSS in UI (calendar, shift preview, user profile) allows an ... - **THR-002**: Cross-Site Request Forgery: authenticated users could be induced to submit state... - **THR-003**: Session tokens or OAuth tokens stored insecurely in localStorage or accessible J... - **THR-010**: Compromised or replayed OAuth tokens from Google OAuth could be used to imperson... - **THR-011**: Broken access control or insufficient tenant scoping may allow a manager/admin/e... - *...and 5 more threats* **Security Controls:** - **[OWASP] V4.1**: [OWASP] Enforce role-based access control with least privilege and separation of duties;... - **[NIST] AC-3**: [NIST] Enforce access restrictions and ensure users are granted access only to authoriz... - **[ISO27001] A.9.1.2**: [ISO27001] An access control policy based on business and security requirements shall be es... - **[NIST] AC-2 (3)**: [NIST] Automate account status changes (enable/disable) and maintain authoritative acco... **Verification:** Audit automation integrations, simulate HR-driven status changes, and verify system enforces new statuses immediately., Review access control policy documentation and interview personnel to confirm implementation., Inspect policy-to-implementation mapping, run access matrix tests, and verify that disabled users cannot access resources., Review role definitions, test access control enforcement across endpoints for each role, and perform privilege escalation attempts. **Priority:** Critical | **Status:** Pending --- #### REQ-005: User profile management, including personal details, company assignment, and manager associations **Related Threats:** - **THR-001**: Reflected or stored XSS in UI (calendar, shift preview, user profile) allows an ... - **THR-002**: Cross-Site Request Forgery: authenticated users could be induced to submit state... - **THR-008**: Credential stuffing, weak passwords, or lack of MFA leads to account takeover of... - **THR-010**: Compromised or replayed OAuth tokens from Google OAuth could be used to imperson... - **THR-011**: Broken access control or insufficient tenant scoping may allow a manager/admin/e... - *...and 3 more threats* **Security Controls:** - **[OWASP] V4.6**: [OWASP] Verify that updates to user profiles and assignments (e.g., company membership) ... - **[NIST] AC-6**: [NIST] Employ least privilege mechanisms for user profile updates and assignment of org... - **[ISO27001] A.9.2.2**: [ISO27001] A formal process for granting and revoking access rights and attributes should b... - **[OWASP] V1.1**: [OWASP] Design systems to maintain clear trust boundaries so profile attributes that det... **Verification:** Review code paths for profile update endpoints, perform unauthorized modification tests, and inspect audit logs., Check privilege assignments for profile-management components and test unauthorized assignment attempts., Review provisioning records and test the end-to-end process for correctness and auditability., Inspect trust boundary design, review data flow diagrams, and test for attribute spoofing. **Priority:** High | **Status:** Pending --- #### REQ-006: Admin-only company CRUD and multi-tenant data isolation (users, shift types, skills scoped per compa... **Related Threats:** - **THR-001**: Reflected or stored XSS in UI (calendar, shift preview, user profile) allows an ... - **THR-002**: Cross-Site Request Forgery: authenticated users could be induced to submit state... - **THR-005**: TLS termination or CDN misconfiguration (weak ciphers, expired certs, missing HS... - **THR-011**: Broken access control or insufficient tenant scoping may allow a manager/admin/e... - **THR-012**: Data leakage across tenants due to incorrect SQL queries, shared caches, or impr... - *...and 5 more threats* **Security Controls:** - **[OWASP] V14.1**: [OWASP] Ensure logical separation of tenant data and enforce access controls to prevent ... - **[NIST] SC-7**: [NIST] Implement controls to separate and protect system components and data flows; app... - **[ISO27001] A.13.2.1**: [ISO27001] Information transfer and segregation mechanisms should be defined to protect the... - **[NIST] AC-6 (10)**: [NIST] Apply tenant-specific access restrictions and scoping to limit access to tenant ... **Verification:** Review data access code, run multi-tenant isolation tests (attempt cross-tenant reads/writes), and inspect database policies., Review policy documents and sample transfer approvals; test that transfers are blocked or logged when not permitted., Verify per-tenant role mappings, test scoped permissions, and run negative tests attempting cross-tenant CRUD., Assess architecture diagrams, test separation of management interfaces, and review network segmentation controls. **Priority:** Critical | **Status:** Pending --- #### REQ-007: Create, read, update, delete shift types with start/end times and association to required skills, sc... **Related Threats:** - **THR-001**: Reflected or stored XSS in UI (calendar, shift preview, user profile) allows an ... - **THR-002**: Cross-Site Request Forgery: authenticated users could be induced to submit state... - **THR-012**: Data leakage across tenants due to incorrect SQL queries, shared caches, or impr... - **THR-013**: SQL injection, NoSQL injection or command injection via poorly validated paramet... - **THR-014**: An attacker could manipulate optimization payloads, acceptance flow, or solver r... - *...and 5 more threats* **Verification:** Manual Review **Priority:** Medium | **Status:** Pending --- #### REQ-008: Manual shift assignment: create, update, delete shifts, with validation to prevent duplicate shifts ... **Related Threats:** - **THR-001**: Reflected or stored XSS in UI (calendar, shift preview, user profile) allows an ... - **THR-002**: Cross-Site Request Forgery: authenticated users could be induced to submit state... - **THR-004**: Open redirect or incorrect OAuth redirect URI validation allows attackers to cap... - **THR-010**: Compromised or replayed OAuth tokens from Google OAuth could be used to imperson... - **THR-012**: Data leakage across tenants due to incorrect SQL queries, shared caches, or impr... - *...and 5 more threats* **Security Controls:** - **[OWASP] V4.4**: [OWASP] Authorize all modification endpoints and verify checks server-side to prevent un... - **[NIST] AU-2**: [NIST] Determine and log auditable events including create, modify, delete operations. - **[ISO27001] A.12.4.1**: [ISO27001] Event logs recording user activities, exceptions, and security events shall be p... - **[NIST] AC-6**: [NIST] Restrict modify/delete/create operations to roles with explicit permissions. **Verification:** Inspect logs for the required events, retention configuration, and access controls around logs., Review permission mappings and test that lower-privileged roles cannot modify shifts., Test role-based access to create/update/delete endpoints, and attempt unauthorized operations., Review audit logs for shift CRUD events and validate completeness and integrity. **Priority:** Critical | **Status:** Pending --- #### REQ-009: Shift status lifecycle and tracking (SCHEDULED, CONFIRMED, COMPLETED, CANCELLED, NO_SHOW) with audit... **Related Threats:** - **THR-001**: Reflected or stored XSS in UI (calendar, shift preview, user profile) allows an ... - **THR-002**: Cross-Site Request Forgery: authenticated users could be induced to submit state... - **THR-012**: Data leakage across tenants due to incorrect SQL queries, shared caches, or impr... - **THR-013**: SQL injection, NoSQL injection or command injection via poorly validated paramet... - **THR-014**: An attacker could manipulate optimization payloads, acceptance flow, or solver r... - *...and 5 more threats* **Security Controls:** - **[NIST] AU-6**: [NIST] Regularly review and analyze audit records for indications of unauthorized activ... - **[OWASP] V10.1**: [OWASP] Ensure logs and status transitions are recorded in tamper-resistant logs and int... - **[ISO27001] A.12.4.3**: [ISO27001] Administrator and operator activities, including status changes, should be logge... - **[NIST] CM-3**: [NIST] Control and document changes to system configuration and state transitions. **Verification:** Check logs for operator entries and review processes for manual status changes., Review change records for status transition rule updates and verify approvals were enforced., Review audit processes, sample status transition logs, and ensure alerts are configured for anomalies., Inspect log storage protections and attempt to modify logs; verify detection of tamper attempts. **Priority:** High | **Status:** Pending --- #### REQ-010: Calendar view with shift preview, search, filtering (by user, shift type, status, date), pagination ... **Related Threats:** - **THR-001**: Reflected or stored XSS in UI (calendar, shift preview, user profile) allows an ... - **THR-002**: Cross-Site Request Forgery: authenticated users could be induced to submit state... - **THR-011**: Broken access control or insufficient tenant scoping may allow a manager/admin/e... - **THR-012**: Data leakage across tenants due to incorrect SQL queries, shared caches, or impr... - **THR-013**: SQL injection, NoSQL injection or command injection via poorly validated paramet... - *...and 5 more threats* **Verification:** Manual Review **Priority:** Medium | **Status:** Pending --- #### REQ-011: Automated shift assignment via external solver API with date range selection, preview of generated a... **Related Threats:** - **THR-001**: Reflected or stored XSS in UI (calendar, shift preview, user profile) allows an ... - **THR-002**: Cross-Site Request Forgery: authenticated users could be induced to submit state... - **THR-004**: Open redirect or incorrect OAuth redirect URI validation allows attackers to cap... - **THR-012**: Data leakage across tenants due to incorrect SQL queries, shared caches, or impr... - **THR-013**: SQL injection, NoSQL injection or command injection via poorly validated paramet... - *...and 5 more threats* **Security Controls:** - **[OWASP] V13.1**: [OWASP] Securely integrate with third-party APIs using mutual authentication, input/outp... - **[NIST] SA-9**: [NIST] Ensure that external interfaces are secured and that integration with external s... - **[ISO27001] A.15.1.1**: [ISO27001] Establish controls for supplier relationships including security requirements fo... - **[NIST] SC-8**: [NIST] Protect the confidentiality and integrity of information during transmission to ... **Verification:** Inspect TLS configuration, perform MITM tests, and verify payload signatures if implemented., Review supplier contracts, interface security documentation, and test compliance with the defined integration policy., Review API authentication configuration, test injection or malformed response handling, and verify server validates solver outputs., Inspect supplier agreements and evidence of supplier security practices and audits. **Priority:** Critical | **Status:** Pending --- #### REQ-012: Asynchronous job processing for optimization requests, with real-time polling, solution status updat... **Related Threats:** - **THR-014**: An attacker could manipulate optimization payloads, acceptance flow, or solver r... - **THR-015**: Queue or job system abuse (poisoned jobs, replayed jobs, or malformed payloads) ... - **THR-021**: Sensitive optimization payloads (employee availability, leave, skills) transmitt... - **THR-028**: Abuse of real-time polling endpoints (frequent polling for optimization status) ... **Security Controls:** - **[NIST] SC-13**: [NIST] Use cryptography to protect data in transit and at rest in asynchronous messagin... - **[OWASP] V14.3**: [OWASP] Ensure job queues and background processing components enforce authentication, a... - **[ISO27001] A.12.1.1**: [ISO27001] Operational procedures should define and control background processing and messa... - **[NIST] SI-7**: [NIST] Implement integrity checks for data processed asynchronously to detect tampering... **Verification:** Inspect integrity verification code paths and attempt to submit tampered payloads to confirm detection., Inspect queue ACLs, test unauthorized enqueue/dequeue attempts, and validate payload schema checks., Review encryption configurations for queues and endpoints, and test interception attempts., Review operational procedures and perform runbook drills to validate behavior. **Priority:** Critical | **Status:** Pending --- #### REQ-013: Solution scoring (hard/soft constraint metrics), constraint violation analysis, and reporting of sol... **Related Threats:** - **THR-014**: An attacker could manipulate optimization payloads, acceptance flow, or solver r... - **THR-021**: Sensitive optimization payloads (employee availability, leave, skills) transmitt... - **THR-022**: Malicious or malformed solver responses could instruct the application to create... **Security Controls:** - **[OWASP] V11.2**: [OWASP] Log inputs, configuration, and outputs of automated decision algorithms to suppo... - **[NIST] PM-22**: [NIST] Document and analyze how automated solutions are validated, scored, and how viol... - **[ISO27001] A.18.1.4**: [ISO27001] Ensure compliance with regulatory requirements for automated processing and prov... - **[NIST] AU-12**: [NIST] Generate audit records for security-relevant events including algorithm outputs ... **Verification:** Inspect audit logs for scoring events and test correlation between algorithm runs and generated logs., Review privacy assessments and validate that logs/reporting exclude unnecessary personal data or are appropriately protected., Review documentation and validation artifacts and confirm reporting pipelines produce expected outputs., Check that algorithmic inputs/outputs are logged and can be correlated to user-visible reports. **Priority:** High | **Status:** Pending --- #### REQ-014: Validation to prevent duplicate shifts across the date range both for manual and auto-assignment wor... **Related Threats:** - **THR-002**: Cross-Site Request Forgery: authenticated users could be induced to submit state... - **THR-004**: Open redirect or incorrect OAuth redirect URI validation allows attackers to cap... - **THR-010**: Compromised or replayed OAuth tokens from Google OAuth could be used to imperson... - **THR-012**: Data leakage across tenants due to incorrect SQL queries, shared caches, or impr... - **THR-013**: SQL injection, NoSQL injection or command injection via poorly validated paramet... - *...and 5 more threats* **Verification:** Manual Review **Priority:** Medium | **Status:** Pending --- #### REQ-015: Employee shift preferences management with date-specific preference types (DESIRED/UNDESIRED) persis... **Related Threats:** - **THR-001**: Reflected or stored XSS in UI (calendar, shift preview, user profile) allows an ... - **THR-002**: Cross-Site Request Forgery: authenticated users could be induced to submit state... - **THR-007**: Absence or weak rate limiting allows brute-force, enumeration, or abusive pollin... - **THR-010**: Compromised or replayed OAuth tokens from Google OAuth could be used to imperson... - **THR-011**: Broken access control or insufficient tenant scoping may allow a manager/admin/e... - *...and 5 more threats* **Security Controls:** - **[ISO27001] A.18.1.4**: [ISO27001] Ensure compliance with regulatory requirements for automated processing and prov... - **[NIST] PL-4**: [NIST] Conduct privacy impact assessments for systems processing personal preferences. - **[OWASP] V1.5**: [OWASP] Design systems to minimize collection of personal data and protect user preferen... - **[NIST] AC-19**: [NIST] Protect user attribute data including preferences with appropriate access contro... **Verification:** Review privacy documentation and confirm preference handling is aligned with policy and retention rules., Test access to preference records from different roles and verify unauthorized reads are blocked., Inspect data schemas and UI controls for preference management and test deletion/exports to ensure removal., Provide PIA documentation and evidence of mitigations implemented based on findings. **Priority:** High | **Status:** Pending --- #### REQ-016: Unavailable dates and leave management (SICK_LEAVE, VACATION, PERSONAL_LEAVE, UNPAID_LEAVE, OTHER) w... **Related Threats:** - **THR-003**: Session tokens or OAuth tokens stored insecurely in localStorage or accessible J... - **THR-013**: SQL injection, NoSQL injection or command injection via poorly validated paramet... - **THR-014**: An attacker could manipulate optimization payloads, acceptance flow, or solver r... - **THR-018**: Database credentials stored insecurely (in code, misconfigured secrets managemen... - **THR-021**: Sensitive optimization payloads (employee availability, leave, skills) transmitt... - *...and 3 more threats* **Security Controls:** - **[ISO27001] A.18.1.4**: [ISO27001] Ensure compliance with regulatory requirements for automated processing and prov... - **[NIST] PL-4**: [NIST] Conduct privacy impact assessments when processing sensitive personal data such ... - **[NIST] MP-6**: [NIST] Protect sensitive personal data at rest and in transit, and sanitize when export... - **[OWASP] V1.5**: [OWASP] Implement privacy-by-design for sensitive employee data, minimizing collection a... **Verification:** Review data classification, access controls, and privacy handling for leave data., Provide PIA output and evidence of mitigations (pseudonymization, restricted access)., Inspect encryption at rest, review export sanitization routines, and test role-based export restrictions., Review UI/data collection forms and retention policies; verify secure storage controls in place. **Priority:** Critical | **Status:** Pending --- #### REQ-017: Skill management: CRUD for skills, skills associated with users and shift types, and skill-based mat... **Related Threats:** - **THR-001**: Reflected or stored XSS in UI (calendar, shift preview, user profile) allows an ... - **THR-002**: Cross-Site Request Forgery: authenticated users could be induced to submit state... - **THR-010**: Compromised or replayed OAuth tokens from Google OAuth could be used to imperson... - **THR-012**: Data leakage across tenants due to incorrect SQL queries, shared caches, or impr... - **THR-013**: SQL injection, NoSQL injection or command injection via poorly validated paramet... - *...and 5 more threats* **Security Controls:** - **[NIST] AC-3 (5)**: [NIST] Support attribute-based access control when access decisions depend on attribute... - **[OWASP] V4.2**: [OWASP] Implement and verify attribute-based authorization where access and matching log... - **[ISO27001] A.9.2.2**: [ISO27001] Provision access and attributes carefully to ensure accurate assignment of skill... - **[NIST] PM-11**: [NIST] Ensure data used for decision making (e.g., skills) is accurate and maintained. **Verification:** Review provisioning logs and sample attribute provenance to ensure correct assignment., Attempt to alter skill attributes via API/UI and confirm authorization prevents incorrect matching., Review ABAC policies and test that assignments respect skill attribute constraints., Check data quality reports and validation procedures for skill records. **Priority:** High | **Status:** Pending --- #### REQ-018: Data export in CSV and XLSX for entities: shifts, users, companies, skills, shift types, preferences... **Related Threats:** - **THR-001**: Reflected or stored XSS in UI (calendar, shift preview, user profile) allows an ... - **THR-002**: Cross-Site Request Forgery: authenticated users could be induced to submit state... - **THR-005**: TLS termination or CDN misconfiguration (weak ciphers, expired certs, missing HS... - **THR-011**: Broken access control or insufficient tenant scoping may allow a manager/admin/e... - **THR-012**: Data leakage across tenants due to incorrect SQL queries, shared caches, or impr... - *...and 5 more threats* **Security Controls:** - **[ISO27001] A.18.1.4**: [ISO27001] Ensure compliance with regulatory requirements for automated processing and prov... - **[NIST] PL-4**: [NIST] Conduct privacy impact assessments when processing sensitive personal data such ... - **[NIST] MP-6**: [NIST] Protect sensitive personal data at rest and in transit, and sanitize when export... - **[OWASP] V1.5**: [OWASP] Implement privacy-by-design for sensitive employee data, minimizing collection a... **Verification:** Review data classification, access controls, and privacy handling for leave data., Provide PIA output and evidence of mitigations (pseudonymization, restricted access)., Inspect encryption at rest, review export sanitization routines, and test role-based export restrictions., Review UI/data collection forms and retention policies; verify secure storage controls in place. **Priority:** Critical | **Status:** Pending --- #### REQ-019: External API integration with Timefold solver: secure payload generation, transport (TLS+auth), solu... **Related Threats:** - **THR-003**: Session tokens or OAuth tokens stored insecurely in localStorage or accessible J... - **THR-004**: Open redirect or incorrect OAuth redirect URI validation allows attackers to cap... - **THR-006**: WAF rule bypass or insufficient WAF rules allow injection payloads (SQLi, XSS) t... - **THR-010**: Compromised or replayed OAuth tokens from Google OAuth could be used to imperson... - **THR-014**: An attacker could manipulate optimization payloads, acceptance flow, or solver r... - *...and 5 more threats* **Security Controls:** - **[OWASP] V11.2**: [OWASP] Log inputs, configuration, and outputs of automated decision algorithms to suppo... - **[NIST] PM-22**: [NIST] Document and analyze how automated solutions are validated, scored, and how viol... - **[ISO27001] A.18.1.4**: [ISO27001] Ensure compliance with regulatory requirements for automated processing and prov... - **[NIST] AU-12**: [NIST] Generate audit records for security-relevant events including algorithm outputs ... **Verification:** Inspect audit logs for scoring events and test correlation between algorithm runs and generated logs., Review privacy assessments and validate that logs/reporting exclude unnecessary personal data or are appropriately protected., Review documentation and validation artifacts and confirm reporting pipelines produce expected outputs., Check that algorithmic inputs/outputs are logged and can be correlated to user-visible reports. **Priority:** High | **Status:** Pending --- #### REQ-020: Internationalization: multi-language support for UI elements and localized date/time formatting per ... **Related Threats:** - **THR-001**: Reflected or stored XSS in UI (calendar, shift preview, user profile) allows an ... - **THR-002**: Cross-Site Request Forgery: authenticated users could be induced to submit state... - **THR-010**: Compromised or replayed OAuth tokens from Google OAuth could be used to imperson... - **THR-011**: Broken access control or insufficient tenant scoping may allow a manager/admin/e... - **THR-012**: Data leakage across tenants due to incorrect SQL queries, shared caches, or impr... - *...and 5 more threats* **Security Controls:** - **[OWASP] V9.7**: [OWASP] Properly handle Unicode, normalization, and encoding to prevent injection and XS... - **[NIST] SC-17**: [NIST] Ensure localized data formats and time/date handling do not weaken security mech... - **[ISO27001] A.14.2.5**: [ISO27001] Include security requirements for localized applications and data handling in de... - **[OWASP] V9.1**: [OWASP] Validate and canonicalize input considering locale-specific encodings and format... **Verification:** Run locale-specific input validation tests and check canonicalization outputs., Test inputs with various Unicode characters and locale-specific formats to detect XSS or parsing issues., Inspect development checklists and localized test cases for security considerations., Review date/time handling code and test across locales for consistent behavior of security-sensitive features. **Priority:** High | **Status:** Pending --- *Showing detailed mappings for 20 of 25 requirements.* --- ## Appendix E: References - [OWASP ASVS 5.0](https://owasp.org/www-project-application-security-verification-standard/) - [NIST Cybersecurity Framework](https://www.nist.gov/cyberframework) - [ISO/IEC 27001:2022](https://www.iso.org/standard/27001) - [OWASP Top 10](https://owasp.org/www-project-top-ten/) - [MITRE ATT&CK Framework](https://attack.mitre.org/) --- *End of Report - Generated by Security Requirements Analysis System v2.0* *Generated: 2025-11-19 19:29:59*